title: A malware detection scheme based on mining format information.
abstract: Malware has become one of the most serious threats to computer information system and the current malware detection technology still has very significant limitations. In this paper, we proposed a malware detection approach by mining format information of PE (portable executable) files. Based on in-depth analysis of the static format information of the PE files, we extracted 197 features from format information of PE files and applied feature selection methods to reduce the dimensionality of the features and achieve acceptable high performance. When the selected features were trained using classification algorithms, the results of our experiments indicate that the accuracy of the top classification algorithm is 99.1% and the value of the AUC is 0.998. We designed three experiments to evaluate the performance of our detection scheme and the ability of detecting unknown and new malware. Although the experimental results of identifying new malware are not perfect, our method is still able to identify 97.6% of new malware with 1.3% false positive rates.
authors.affiliation: College of Computer Science, Sichuan University, Chengdu 610065, China ; School of Information Technology and Engineering, Yuxi Normal University, Yuxi 653100, China.
authors.forename: Jinrong
authors.initials: J
authors.lastname: Bai
authors.affiliation: College of Computer Science, Sichuan University, Chengdu 610065, China.
authors.forename: Junfeng
authors.initials: J
authors.lastname: Wang
authors.affiliation: School of Information Technology and Engineering, Yuxi Normal University, Yuxi 653100, China.
authors.forename: Guozhong
authors.initials: G
authors.lastname: Zou
mesh_terms: D000465:Algorithms; D001185:Artificial Intelligence; D057225:Data Mining / Q000379:methods*; D010363:Pattern Recognition, Automated / Q000379:methods*