Efficient algorithm for malware classification: N-gram MCSC

Abstract

In this paper, we proposed n-gram MCSC. This method extracts n-gram opcode from execution file and use Simhash to make image of them. We measured and compared the performance metrics of n-gram MCSC and existing MCSC such as accuracy, loss, precision and AUC value of PR curve and ROC curve. To verify whether the difference of accuracy is significant statistically or not, we made experiments of it thirty times and did the ANOVA analysis. We found it was significant. As the result of post-hoc analysis, n-gram MCSC showed better result than existing MCSC in accuracy. The 2-gram MCSC showed the better result than 3-gram MCSC in terms of accuracy, precision, AUC value of PR curve and ROC curve.