Source-linked AI summary
Performance analysis of Machine learning algorithms for predicting malware
ABM. Adnan Azmee, Pranto Protim Choudhury, Md. Aosaful Alam, Orko Dutta, Muhammad Iqbal Hossain
TL;DR
The paper addresses malware detection challenges arising from evolving threats and limitations of signature-based antivirus. It proposes a machine-learning framework that preprocesses malware data, compares classifiers, and supports executable-file classification; within the supplied evaluation, ANN is reported as the best-performing model.
Problem
Signature-based antivirus struggles to detect newly emerging malware before updated signatures become available.
Method
The study preprocesses labeled malware data and evaluates Naive Bayes, logistic regression, and ANN classifiers using standardized inputs.
Results
ANN achieved 99.56% accuracy, with TPR 0.99, FPR 0.021, and AUC 0.99 in the reported comparison.
Takeaways & Limitations
The reported comparison identifies ANN as the strongest of the three evaluated methods for the proposed malware-detection model.
Abstract
from arXiv · showhide
Malware poses a persistent and evolving threat to modern computing systems, making accurate and timely detection a critical cybersecurity challenge. Traditional signature-based antivirus solutions often fail to identify newly emerging malware, leaving systems vulnerable until updated signatures become available. To address this limitation, this study proposes a machine learning-based malware detection framework capable of distinguishing malicious software from benign applications with high accuracy. Several state-of-the-art classification algorithms, including Artificial Neural Networks (ANN), Support Vector Machines (SVM), XGBoost, and Extra Trees Classifier, were evaluated and compared using a benchmark malware dataset. Experimental results demonstrate that XGBoost achieved the best performance, attaining an accuracy of 98.62%, outperforming the other evaluated models. To demonstrate the practical applicability of the proposed approach, a real-time client-server malware detection system was also developed using the Flask framework, enabling efficient classification of executable files as malicious or benign. The findings highlight the effectiveness of advanced machine learning techniques for enhancing malware detection and contribute toward the development of intelligent and scalable cybersecurity solutions.
I. INTRODUCTION
Malware can disrupt systems, steal data, and spread through disguised or vulnerable software. Traditional signature-based antivirus struggles with zero-day and evolving attacks, motivating machine-learning-based detection.
- Malware is malicious code that can disrupt, cripple, or take control of computer systems without user approval.
- Malware can exploit operating-system, hardware, and software vulnerabilities to steal data, records, money, or computing resources.
- Malware spreads in multiple forms, including infections concealed in apparently harmless files or applications.
- Malware can cause slow performance, pop-up advertisements, website redirection, and unwanted media playback.
- Traditional host-based detectors can be evaded through obfuscation, polymorphism, or reordering of malware system calls.
- Signature-based antivirus fails against zero-day attacks because signatures require reverse engineering and database updates after new malware appears.
II. LITERATURE REVIEW
Prior malware-detection studies compare varied feature sets, datasets, algorithms, and deployment settings. The reviewed work motivates broader evaluation using more data and algorithms.
- Earlier work used integrated and raw portable-executable features, six algorithms, tenfold cross-validation, and two VirusShare-derived datasets.
- The integrated feature set consistently outperformed the raw feature set across repeated feature-number changes.
- One enterprise-focused model achieved 98% accuracy but was described as unsuitable for home personal computers.
- A real-time PE malware system used feature extraction, selection, and classification, but evaluated only 552 samples and reported 97.25% accuracy.
- The reviewed studies also examined feature-selection methods and compared support vector machines, random forests, and artificial neural networks.
III. WORK PLAN AND OUR PROPOSED APPROACH
The proposed approach preprocesses labeled malware data and compares probabilistic, regression, and neural-network classifiers. It uses standardization and an ANN architecture with two hidden layers and specified training components.
- The workflow label-encodes targets, checks missing values, splits data into training and test sets, and standardizes features to mean 0 and standard deviation 1.
- Gaussian Naive Bayes classifies samples using conditional probability while assuming each feature contributes independently to the classification.
- Logistic regression predicts categorical outcomes after standard-scaler preprocessing, using a sigmoid probability and a decision threshold.
- The ANN uses input, hidden, and output layers, with two hidden layers, ReLU and sigmoid activations, cross-entropy loss, and Adam optimization.
IV. EVALUATION
The evaluation uses a balanced 100,000-sample malware dataset and compares classifier performance with detection metrics and ROC analysis. Among the three evaluated algorithms, ANN performs best, with an AUC of 0.99 and 98.6% accuracy.
- Dataset: 100,000 samples comprise 50,000 benign and 50,000 malignant instances.A heatmap visualizes correlations among the input data.
- Evaluation metrics: The evaluation measures true-positive rate, false-positive rate, and accuracy-related performance.TPR represents the classifier’s ability to identify malicious samples, while FPR represents benign samples wrongly classified as malware.
- Overall comparison: Table 1 identifies the artificial neural network as the best-performing algorithm among the three evaluated methods.The table reports the experimental comparison summarized in the evaluation.
- ROC analysis: The ROC plot places false-positive rate on the x-axis and true-positive rate on the y-axis for Naïve Bayes, Logistic regression, and ANN.The curves compare the three algorithms’ classification behavior.
- Classification results: ANN achieves an AUC of 0.99 and 98.6% detection accuracy, outperforming Naïve Bayes and Logistic regression.Naïve Bayes records AUC 0.86 and 69.5% accuracy, while Logistic regression records AUC 0.97 and 93.7% accuracy.
V. CONCLUSION AND FUTURE WORKS
The proposed model compares Naïve Bayes, Logistic regression, and ANN using a labeled 100,000-sample dataset with two hidden layers, cross-entropy, and Adam optimization. ANN achieves the highest reported accuracy, while the authors state that further research is needed to assess and improve the approach.
- Model design: The model combines Naïve Bayes and Logistic regression classifiers with an ANN using two hidden layers, cross-entropy, and Adam optimization.The classifiers are evaluated on a labeled dataset of 100,000 samples.
- Results: 99.56% accuracy is achieved by ANN, compared with 93.745% for Logistic regression and 69.515% for Naïve Bayes.ANN also reports TPR 0.99, FPR 0.021, and AUC 0.99.
- Future work: The authors state that more research is needed to fully assess the approach and improve its technique and accuracy.The reported findings are described as preliminary and promising.