MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm

This paper focuses on training machine learning models using the XGBoost and extremely randomized trees algorithms on two datasets obtained using static and dynamic analysis of real malicious and benign samples. We then compare their success rates—both mutually and with other algorithms, such as the...

Full description

Saved in:
Bibliographic Details
Published inApplied sciences Vol. 12; no. 13; p. 6672
Main Authors Palša, Jakub, Ádám, Norbert, Hurtuk, Ján, Chovancová, Eva, Madoš, Branislav, Chovanec, Martin, Kocan, Stanislav
Format Journal Article
LanguageEnglish
Published Basel MDPI AG 01.07.2022
Subjects
Algorithms
Bayesian analysis
Classification
Contemporary problems
cybersecurity
Datasets
dynamic analysis
Learning algorithms
Machine learning
Malware
Software
static analysis
supervised machine learning
Support vector machines
Online AccessGet full text

Cover

More Information
Summary:This paper focuses on training machine learning models using the XGBoost and extremely randomized trees algorithms on two datasets obtained using static and dynamic analysis of real malicious and benign samples. We then compare their success rates—both mutually and with other algorithms, such as the random forest, the decision tree, the support vector machine, and the naïve Bayes algorithms, which we compared in our previous work on the same datasets. The best performing classification models, using the XGBoost algorithm, achieved 91.9% detection accuracy and 98.2% sensitivity, 0.853 AUC, and 0.949 F1 score on the static analysis dataset, and 96.4% accuracy and 98.5% sensitivity, 0.940 AUC, and 0.977 F1 score on the dynamic analysis dataset. Then, we exported the best performing machine learning models and used them in our proposed MLMD program, automating the process of static and dynamic analysis and allowing the trained models to be used for classification on new samples.
ISSN:2076-3417
2076-3417
DOI:10.3390/app12136672