SMASH: A Malware Detection Method Based on Multi-Feature Ensemble Learning

With the increasing variants of malware, it is of great significance to detect malware and ensure system security effectively. The existing malware dynamic detection methods are vulnerable to evasion attacks. For this situation, we propose a malware dynamic detection method based on mufti-feature en...

Full description

Saved in:
Bibliographic Details
Published in:IEEE access 2019, Vol.7, p.112588-112597
Main Authors: Dai, Yusheng, Li, Hui, Qian, Yekui, Yang, Ruipeng, Zheng, Min
Format: Article
Language:English
Subjects:
Algorithms
Anti-evasion
Cybersecurity
Data mining
Detectors
dynamic detection
Ensemble learning
Feature extraction
Gray-scale
Hardware
hardware features
Machine learning
Malware
memory dump
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:With the increasing variants of malware, it is of great significance to detect malware and ensure system security effectively. The existing malware dynamic detection methods are vulnerable to evasion attacks. For this situation, we propose a malware dynamic detection method based on mufti-feature ensemble learning. Firstly, the method adopts the combination of software features such as API call sequence with high detection precision and low-level hardware features such as resistance to evasion the memory dump grayscale and hardware performance counters. Secondly, we improve each feature based on the original research. We select a more advanced classifier model to improve the detection precision of a single feature. Finally, an ensemble learning algorithm composed of multiple classification algorithms detects malware, the multi-features can describe malware behavior from multi-dimensions to improve detection performance. We use a large number of malware sample dataset to experiment, and the results show that our detection method can obtain good detection precision rate, and is better than other recently proposed dynamic detection methods in anti-evasion performance.
ISSN:2169-3536
2169-3536
DOI:10.1109/ACCESS.2019.2934012