PE Static Malware Analysis with Minimal Features
摘要
This work presents a static malware detection system using seven different classifiers: K-Nearest Neighbors (KNN), Naïve Bayes, Random Forest, Decision Trees, Logistic Regression, Gradient Boosting, and Artificial Neural Networks (ANN). The system focuses on five essential features: hash, size of data, virtual address, virtual size, and entropy, extracted from the Portable Executable (PE) Section Headers of the.text and.code sections. A dataset of 41,568 malicious and 1,725 benign PE files, curated from Cuckoo Sandbox reports, was used for classification. This dataset comprises six columns and 43,293 rows, providing a robust foundation for analysis and classification. The experimental results revealed that leveraging only these five features led to an impressive accuracy of 98.70% with the Random Forest classifier, underscoring the effectiveness of these minimal features in malware detection and the potential for creating efficient detection systems with fewer attributes.