Dynamic Analysis of Malware using Decision Trees

Ravinder R. Ravula,Chien-Chung Chan,K. Liszka

DOI: https://doi.org/10.5220/0003660200740083

2018-07-31

Abstract:Detecting new and unknown malware is a major challenge in today1s software security profession. Most existing works for malware detection are based on static features of malware. In this work, we applied a reversed engineering process to extract static and behavioural features from malware. Two data sets are created based on reversed features and API Call features. Essential features are identified by applying Weka’s J48 decision tree classifier to 582 malware and 521 benign software samples collected from the Internet. The performance of decision tree and Naïve Bayes classifiers are evaluated by 5-fold cross validation with 80-20 splits of training sets. Experimental results show that Naïve Bayes classifier has better performance on the smaller data set with 12 reversed features, while J48 has better performance on the data set created from the API Call data set with 141 features.