Machine Learning Aided Static Malware Analysis: A Survey and Tutorial

1 Introduction

• Dynamic analysis can be evaded, offers only a behavioral snapshot, and consumes substantial resources, while static analysis is slow and requires human interpretation.Static analysis extracts binary characteristics such as function calls and header sections, which may provide indicators of malicious activity for CTI.Source: §1 · pp. 2–3
• The authors identify a gap in comparative studies of ML-based static malware analysis using a single dataset, despite the continued prevalence of 32-bit Windows malware.They propose that automated ML analysis could speed investigation and reduce human interaction in binary processing.Source: §1 · p. 3
• The paper surveys ML methods for static PE32 malware analysis, develops a feature-and-method taxonomy, and provides a tutorial comparing techniques on shared datasets.The authors note that many surveyed studies used their own collections, which were sometimes unavailable or unpublished.Source: §1 · p. 3

2 An overview of Machine Learning-aided static malware detection

• The section examines detectable static properties of 32-bit PE malware and describes machine-learning techniques for static malware analysis.Its stated aim is to develop a taxonomy of the techniques.Source: §2 · p. 3

2.1 Static characteristics of PE files

• PE files contain COFF headers, section tables, data directories, and an Import Address Table; other extractable features include strings, entropy, and section sizes.The paper treats these as static characteristics of executable binaries.Source: §2.1 · p. 4
• Static characteristics become ML inputs as numerical measures or nominal categories, including API function calls.The passage gives CPU usage and file type as examples of numerical and nominal features, respectively.Source: §2.1 · p. 4
• Prior work constructs features from byte and opcode n-grams, API calls, PE headers, strings, and other structural or raw-file data.Reported examples include up to 97% accuracy for byte n-grams and 98% for an SVM using PE-header characteristics.Source: §2.1 · pp. 4–5
• The reviewed literature spans 2000–2016, and the number of relevant studies grew from 2009 onward.The authors suggest this rise may reflect increasing Windows users and malware families.Source: §2.1 · p. 5, Figure 1 · p. 6
• No static characteristic guarantees perfect detection; obfuscation and encryption challenge detection, while byte n-grams can be resource-intensive and impractical in real-world use.Some feature-construction techniques achieved precision above 90%, according to the passage.Source: §2.1 · p. 6

2.2.1 Statistical methods

• Naive Bayes estimates class probabilities under feature-independence assumptions, while Bayesian networks model conditional dependencies and can be adapted for malware classification.The section also describes classification by selecting the class with the greatest likelihood.Source: §2.2.1 · pp. 6–9

2.2.2 Rule based

• C4.5 builds decision trees by selecting information-gain splits, while Neuro-Fuzzy methods combine neural learning with fuzzy rules for interpretable classification.C4.5 supports continuous and missing values; logical rules can also speed hardware-level decisions.Source: §2.2.2 · pp. 10–11

2.2.3 Distance based

• k-NN classifies by the labels of nearby training samples, whereas SVMs separate classes with maximum-margin hyperplanes and can use kernel transformations.Malware applications of these methods require attention to feature selection, outliers, and mixed data.Source: §2.2.3 · pp. 11–12

2.2.4 Neural networks

• Neural networks classify high-dimensional data by training connection weights through back-propagation to reduce output errors.The described network has input, hidden, and output layers, and training can stop at a chosen cycle count or accuracy.Source: §2.2.4 · pp. 13–14, Figure 4 · p. 13

2.2.5 Open Source and Freely available ML Tools

• The surveyed tools include Weka and its Python wrapper, SVM libraries, RapidMiner, and Dlib; Weka lacks multithreading and uses memory poorly on large datasets.The wrapper provides Weka functionality with additional automation, while Dlib supports multithreading and Python APIs.Source: §2.2.5 · p. 14

2.2.6 Feature Selection & Construction process

• Feature selection removes irrelevant or redundant characteristics, reducing a potentially large feature set to those useful for distinguishing malware from benign applications.The section names Information Gain and Correlation-based Feature Subset Selection as common methods.Source: §2.2.6 · pp. 14–15

• The taxonomy groups common static-analysis methods into characteristic extraction, feature selection, and machine-learning classification, using Statistical Pattern Recognition as its basis.The taxonomy is shown in Figure 5.Source: §2.3 · p. 15, Figure 5 · p. 15
• Byte n-grams, opcode n-grams, and PE32 header fields were common characteristics; Information Gain was prevalent, while C4.5, SVM, and k-NN were frequently used classifiers.N-gram methods tended to pair with tf-idf and Symmetric Uncertainty, while header-based features tended to pair with Control-Flow graph methods and Gain Ratio.Source: §2.3 · p. 17, Figure 6 · p. 17
• Reported accuracies ranged from 80–100% in most studies, while some Bayes-based methods reached as low as 50%.The review also notes rule-based methods and SVM as common classifiers, forest-based methods for PE32 header features, and ANN as uncommon.Source: §2.3 · p. 18

• PE32 header features include directory and section information, file size, signatures, packer, anti-debug and anti-VM indicators, and suspicious APIs or sections.The experiments use numerical features extracted with PEframe, including flags for executable versus DLL status and detected evasion techniques.Source: §3 · p. 18
• For malware classification, Reddy et al. used 2-, 3-, and 4-grams with SVM, instance-based learning, and decision trees; class-wise document frequency outperformed Information Gain, while Jain et al. reported byte 3-grams best among lengths 1–8.Source: §3 · p. 19
• Opcode n-grams represent sequences of CPU instructions obtained by disassembling an executable, and prior work used lengths of 1–4 for classification.The cited methods included Random Forest, J48, k-nearest neighbours, Bayesian Networks, and SVM.Source: §3 · p. 19
• API-call features use operating-system routine usage to identify calls that may distinguish malicious from benign software; these experiments use 1- and 2-grams.Prior work cited in the section reported 97.23% accuracy with 1-gram features and 97.7% with 3-grams.Source: §3 · p. 19

• Experiments ran in an Ubuntu 14.04 virtual machine with 8 GB of available memory, using bash preprocessing scripts and MySQL 5.5 with Python 2.7.6 and PHP 5.5.9 connectors.The VM ran on Xen 4.4 and received two CPU cores (four threads).Source: §4 · p. 19
• The benign set was assembled from known-good software across 32-bit Windows XP, Windows 7, Windows 8.1, and Windows 10, while malware came from VX Heaven and VirusShare.The authors state that no large benign-software reference dataset had been published to their knowledge, so they created their own benign set.Source: §4 · p. 20
• Samples outside the PE32 executable scope were filtered out, and duplicate files were renamed using their MD5 sums before PE32 detection and collection.The authors describe handling more than 100,000 files as requiring non-trivial processing approaches.Source: §4 · p. 20
• Extracted features were stored in MySQL after multiple feature-extraction rounds, with PEframe, hexdump, and objdump used for feature construction or inspection.PEframe extracts PE information including packers and anti-debugging or anti-VM indicators.Source: §4 · pp. 21–22
• Table 2 presents characteristics of the collected dataset after PE-file filtering, and the text identifies the resulting sets as the experiment data.The supplied passages do not state the table's specific counts or values.Source: Table 2 · p. 21, §4 · p. 21

5 Results & Discussions

• Compilation-time distributions were used to assess dataset representativeness, with benign-file spikes corresponding to Windows releases and malware increases following newer releases.The malware 000 dataset also has suspicious timestamps before 1981 or after January 2012, given its stated collection boundary.Source: §5 · p. 22, Figure 7 · p. 23, Figure 8 · p. 23

5.1.1 PE32 header

• Short Info PE32 fields served as standalone indicators, with directory counts, file size, and EXE/DLL flags more informative than other fields.Anti Debug and Suspicious API fields could not classify binaries; digital signatures and Anti VM fields were nearly irrelevant.Source: §5.1.1 · p. 23, Table 3 · p. 24
• ANN and C4.5 performed much better than other methods on PE32 features, while malware 000 and malware 207 were harder to distinguish than benign files from malware 000.Experiments used five-fold cross-validation, and the ANN had three hidden layers.Source: §5.1.1 · p. 25, Table 4 · p. 25

5.1.2 Bytes n-gram

• Bytes n-gram randomness profiles had limited accuracy, particularly because file sizes ranged from around 0.5 KB to 53.7 MB and affected the method’s localness.ANN performed best for benign versus malware 000, while C4.5 performed best for the other two dataset comparisons.Source: §5.1.2 · pp. 25–26, Table 5 · p. 26, Figure 10 · p. 26

5.1.3 Opcode n-gram

• C4.5 performed well on opcode n-grams, and feature selection reduced 200 features to 10–15 without a significant overall accuracy drop.For C4.5, 3-grams did a bit better on benign-versus-malware comparisons, while 4-grams did better on the malware-dataset comparison; malware classes also showed strong frequency correlation.Source: §5.1.3 · pp. 27, 29, Figure 12 · p. 29, Figure 13 · p. 30

5.1.4 API call n-grams

• ANN, k-NN, and C4.5 were the best API-call classifiers, but distinguishing malware 000 from malware 207 remained more difficult.The authors report lower accuracy than related studies and attribute this partly to their dataset having more than 110,000 files; malware programs used GetProcAddress() more often.Source: §5.1.4 · pp. 31–32, Table 10 · p. 31, Table 11 · p. 32

6 Conclusion

• The paper surveys machine-learning methods for static analysis of PE32 Windows malware.It covers extracting static characteristics and classifying them with machine-learning methods.Source: §6 · p. 32
• The authors provide a taxonomy of static malware features and corresponding machine-learning methods, alongside a tutorial on applying methods to benign and malware datasets.Source: §6 · p. 32
• C4.5 and k-NN perform better than other methods in most cases, while SVM and ANN perform well on some feature sets.Bayes Network and Naive Bayes perform poorly relative to other methods; the authors link this to very low probabilities in many features, including opcode and byte n-grams.Source: §6 · pp. 32–33
• The authors conclude that machine-learning aided static analysis can classify benign and malicious PE32 samples and support CTI activities by automating detection of indications of compromise from static features.Source: §6 · p. 33