Windows PE Malware Detection Using Ensemble Learning
In this Internet age, there are increasingly many threats to the security and safety of users daily. One of such threats is malicious software otherwise known as malware (ransomware, Trojans, viruses, etc.). The effect of this threat can lead to loss or malicious replacement of important information...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-02-01
|
| Series: | Informatics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2227-9709/8/1/10 |
| _version_ | 1827601031374045184 |
|---|---|
| author | Nureni Ayofe Azeez Oluwanifise Ebunoluwa Odufuwa Sanjay Misra Jonathan Oluranti Robertas Damaševičius |
| author_facet | Nureni Ayofe Azeez Oluwanifise Ebunoluwa Odufuwa Sanjay Misra Jonathan Oluranti Robertas Damaševičius |
| author_sort | Nureni Ayofe Azeez |
| collection | DOAJ |
| description | In this Internet age, there are increasingly many threats to the security and safety of users daily. One of such threats is malicious software otherwise known as malware (ransomware, Trojans, viruses, etc.). The effect of this threat can lead to loss or malicious replacement of important information (such as bank account details, etc.). Malware creators have been able to bypass traditional methods of malware detection, which can be time-consuming and unreliable for unknown malware. This motivates the need for intelligent ways to detect malware, especially new malware which have not been evaluated or studied before. Machine learning provides an intelligent way to detect malware and comprises two stages: feature extraction and classification. This study suggests an ensemble learning-based method for malware detection. The base stage classification is done by a stacked ensemble of fully-connected and one-dimensional convolutional neural networks (CNNs), whereas the end-stage classification is done by a machine learning algorithm. For a meta-learner, we analyzed and compared 15 machine learning classifiers. For comparison, five machine learning algorithms were used: naïve Bayes, decision tree, random forest, gradient boosting, and AdaBoosting. The results of experiments made on the Windows Portable Executable (PE) malware dataset are presented. The best results were obtained by an ensemble of seven neural networks and the ExtraTrees classifier as a final-stage classifier. |
| first_indexed | 2024-03-09T04:47:27Z |
| format | Article |
| id | doaj.art-f5714d339c9240308f942ac46f59d0e0 |
| institution | Directory Open Access Journal |
| issn | 2227-9709 |
| language | English |
| last_indexed | 2024-03-09T04:47:27Z |
| publishDate | 2021-02-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Informatics |
| spelling | doaj.art-f5714d339c9240308f942ac46f59d0e02023-12-03T13:14:45ZengMDPI AGInformatics2227-97092021-02-01811010.3390/informatics8010010Windows PE Malware Detection Using Ensemble LearningNureni Ayofe Azeez0Oluwanifise Ebunoluwa Odufuwa1Sanjay Misra2Jonathan Oluranti3Robertas Damaševičius4Department of Computer Sciences, Faculty of Science, University of Lagos, Lagos 100001, NigeriaDepartment of Computer Sciences, Faculty of Science, University of Lagos, Lagos 100001, NigeriaCenter of ICT/ICE Research, CUCRID, Covenant University, Ota 112212, NigeriaCenter of ICT/ICE Research, CUCRID, Covenant University, Ota 112212, NigeriaDepartment of Applied Informatics, Vytautas Magnus University, 44404 Kaunas, LithuaniaIn this Internet age, there are increasingly many threats to the security and safety of users daily. One of such threats is malicious software otherwise known as malware (ransomware, Trojans, viruses, etc.). The effect of this threat can lead to loss or malicious replacement of important information (such as bank account details, etc.). Malware creators have been able to bypass traditional methods of malware detection, which can be time-consuming and unreliable for unknown malware. This motivates the need for intelligent ways to detect malware, especially new malware which have not been evaluated or studied before. Machine learning provides an intelligent way to detect malware and comprises two stages: feature extraction and classification. This study suggests an ensemble learning-based method for malware detection. The base stage classification is done by a stacked ensemble of fully-connected and one-dimensional convolutional neural networks (CNNs), whereas the end-stage classification is done by a machine learning algorithm. For a meta-learner, we analyzed and compared 15 machine learning classifiers. For comparison, five machine learning algorithms were used: naïve Bayes, decision tree, random forest, gradient boosting, and AdaBoosting. The results of experiments made on the Windows Portable Executable (PE) malware dataset are presented. The best results were obtained by an ensemble of seven neural networks and the ExtraTrees classifier as a final-stage classifier.https://www.mdpi.com/2227-9709/8/1/10malware detectiondeep learningensemble learningstacking |
| spellingShingle | Nureni Ayofe Azeez Oluwanifise Ebunoluwa Odufuwa Sanjay Misra Jonathan Oluranti Robertas Damaševičius Windows PE Malware Detection Using Ensemble Learning Informatics malware detection deep learning ensemble learning stacking |
| title | Windows PE Malware Detection Using Ensemble Learning |
| title_full | Windows PE Malware Detection Using Ensemble Learning |
| title_fullStr | Windows PE Malware Detection Using Ensemble Learning |
| title_full_unstemmed | Windows PE Malware Detection Using Ensemble Learning |
| title_short | Windows PE Malware Detection Using Ensemble Learning |
| title_sort | windows pe malware detection using ensemble learning |
| topic | malware detection deep learning ensemble learning stacking |
| url | https://www.mdpi.com/2227-9709/8/1/10 |
| work_keys_str_mv | AT nureniayofeazeez windowspemalwaredetectionusingensemblelearning AT oluwanifiseebunoluwaodufuwa windowspemalwaredetectionusingensemblelearning AT sanjaymisra windowspemalwaredetectionusingensemblelearning AT jonathanoluranti windowspemalwaredetectionusingensemblelearning AT robertasdamasevicius windowspemalwaredetectionusingensemblelearning |