Malware Classification Using Low-Level Characteristics

Abstract

Malware is growing at breakneck speed and has become a global problem. Malware detection has reached a high accuracy level of nearly 100%; however, malware classification is still challenging. Distinguishing and classifying different types of malware from each other is essential to better understanding how they can infect computers and devices, their threat level, and how to protect against them. Traditional malware classification works based on signature and behavior approaches. This approach is fragile in address with polymorphic and metamorphic malware. Moreover, because of the rapid development of several automatic malware creation tools, these methods cannot catch up to the speed of malware generation. Machine learning has handled most of today’s problems with models ranging from simple to complex. Current studies focus on high-level characteristics of malware, which require high computational costs to detect and classify malware via complex neural network architectures, but the performance is still not groundbreaking. On the contrary, low-level characteristics still have much potential but are still not fully exploited. This study takes the advance of ensembling two low-level characteristic sets, including registers and opcodes, and selecting the appropriate features through the selection feature algorithm to increase performance and reduce computational costs. Proposed method outperformed previous works on two different malware data. This paper shows that extraction and selection features are no less critical than it is for architecture development.