Evaluation of System Features Used for Malware Detection

Abstract

For the current detection of malware, automatic detection tools are widely used that apply machine learning techniques and algorithms. In these approaches, it is very important to define suitable features that are as significant as possible in order to distinguish samples from individual groups intended for training. However, when using these approaches in some domains, especially security, these features must also meet other requirements because behind the attacks and malicious applications is intelligence, i.e. human intelligence. For this reason, there is a high risk of modification of selected features, making them difficult or impossible to use these detection algorithms. In this paper, we have defined the requirements that we consider important when looking for suitable features. Based on these requirements we have also selected some features that meet these requirements. We aim to show the extent to which our selected proof-of-concept features also meet the additional requirements necessary for successful detection, such as significance and interpretability. We use ML methods to discriminate between malicious and benign codes based on these features. We achieved the accuracy between 98 and 99%, based on the ML methods used.