Machine Learning Methods for Malware Detection and Classification
This project is my final work for the Bachelor of Engineering degree in South-Eastern Finland University of APplied Sciences. The idea was to build the machine learning based classification of malware on top of the Cuckoo Sandbox, test how it can detect unknown malware (to simulate polymorphic or zero-day behavior) and evaluate the accuracy compared to the current signature-based methods.
Specifically, k-Nearest-Neighbors, Decision Trees, Support Vector Machines, Naive Bayes and Random Forest classifiers were evaluated. The dataset used for this study consistsed of the 1156 malware files of 9 families of different types and 984 benign files of various formats. The familes included Dridex, Locky, CTB-Locker, TeslaCrypt, Vawtrak, Zeus, Darkcomet, Cybergate, Xtreme.
If you find the work useful, kindly cite is as:
@article{chumachenko2017machine,
title={Machine learning methods for malware detection and classification},
author={Chumachenko, Kateryna and others},
year={2017},
publisher={Kaakkois-Suomen ammattikorkeakoulu}
}
UPD
The amount of requests to share the data used for analysis has been high, but unfortunately it is not possible for me to do this at this point due to restrictions related to its sensitivity.