a-tartarelli / malware-detection

Malware detection using machine learning and deep learning algoritms based on O.S. API calls

Malware detection

Malware detection using machine learning and deep learning algorithms based on O.S. (Windows) API calls sequence

Algorithms used:

• Random Forest
• CatBoost
• XGBoost
• ExtraTrees
• TabNet
• NODE

Dataset:

• malware-analysis-datasets-api-call-sequences: It contains 42,797 malware API call sequences and 1,079 goodware API call sequences. Each API call sequence is composed of the first 100 non-repeated consecutive API calls associated with the parent process, extracted from the 'calls' elements of Cuckoo Sandbox reports.
• APIMDS: Consists of 23,080 malware samples randomly chosen from two other datasets: the Malicia project and Virus Total.

Results

APIMDS

All results are 10-folds average, on left side you can see my result and on right side there are the results of the benchmark develop by ISLab laboratory of the department of computer science, university of Bari.

Algorithm	Precision	Recall	F1 score	AUC ROC	Precision	Recall	F1 score	AUC ROC
Random Forest	0.9936	0.9265	0.9572	0.9265	0.9914	0.9215	0.9532	0.9215
CatBoost	0.9933	0.9743	0.9834	0.9743	0.9955	0.9399	0.9655	0.9399
XGBoost	0.9934	0.9711	0.9815	0.9711	0.9944	0.9619	0.9779	0.9632
ExtraTree	0.9938	0.9297	0.9591	0.9297	0.9949	0.9132	0.9498	0.9132
NODE	0.9956	0.8547	0.9127	0.8547	0.9948	0.9166	0.9519	0.0022
TabNet	0.9449	0.9243	0.9334	0.9243	0.9843	0.9264	0.9529	0.9264

Malware-analysis-datasets-api-call-sequences

The same applies to these results.

Algorithm	Precision	Recall	F1 score	AUC ROC	Precision	Recall	F1 score	AUC ROC
Random Forest	0.958	0.819	0.874	0.819	0.9650	0.8090	0.8690	0.8094
CatBoost	0.954	0.831	0.882	0.831	0.9620	0.8200	0.8770	0.8201
XGBoost	0.956	0.839	0.888	0.839	0.9575	0.7816	0.8473	0.7816
ExtraTree	0.964	0.748	0.822	0.748	0.9700	0.7411	0.8162	0.7411
NODE	0.9888	0.7624	0.8376	0.7624	0.9532	0.7238	0.7971	0.7238
TabNet	0.872	0.801	0.830	0.801	0.8985	0.7674	0.8166	0.7674