Impact of Portable Executable Header Features on Malware Detection Accuracy  

作　　者：Hasan H.Al-Khshali Muhammad Ilyas 

机构地区：[1]Electrical and Computer Engineering,Altinbas University,Istanbul,Turkey [2]Electrical and Electronics Engineering,Altinbas University,Istanbul,Turkey

出　　处：《Computers, Materials & Continua》2023年第1期153-178,共26页计算机、材料和连续体（英文）

摘　　要：One aspect of cybersecurity,incorporates the study of Portable Executables(PE)files maleficence.Artificial Intelligence(AI)can be employed in such studies,since AI has the ability to discriminate benign from malicious files.In this study,an exclusive set of 29 features was collected from trusted implementations,this set was used as a baseline to analyze the presented work in this research.A Decision Tree(DT)and Neural Network Multi-Layer Perceptron(NN-MLPC)algorithms were utilized during this work.Both algorithms were chosen after testing a few diverse procedures.This work implements a method of subgrouping features to answer questions such as,which feature has a positive impact on accuracy when added?Is it possible to determine a reliable feature set to distinguish a malicious PE file from a benign one?when combining features,would it have any effect on malware detection accuracy in a PE file?Results obtained using the proposed method were improved and carried few observations.Generally,the obtained results had practical and numerical parts,for the practical part,the number of features and which features included are the main factors impacting the calculated accuracy,also,the combination of features is as crucial in these calculations.Numerical results included,finding accuracies with enhanced values,for example,NN_MLPC attained 0.979 and 0.98;for DT an accuracy of 0.9825 and 0.986 was attained.

关 键 词：AI driven cybersecurity artificial intelligence CYBERSECURITY Decision Tree Neural Network Multi-Layer Perceptron Classifier portable executable(PE)file header features 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论] TP309[自动化与计算机技术—计算机科学与技术]