A Chi-Square-Based Decision for Real-Time Malware Detection Using PE-File Features

Mohamed Belaoued and Smaine Mazouzi
Volume: 12, No: 4, Page: 644 ~ 660, Year: 2016
10.3745/JIPS.03.0058
Keywords: Chi-Square Test, Malware Analysis, PE-Optional Header, Real-Time Detection Windows API
Full Text:

Abstract
The real-time detection of malware remains an open issue, since most of the existing approaches for malware categorization focus on improving the accuracy rather than the detection time. Therefore, finding a proper balance between these two characteristics is very important, especially for such sensitive systems. In this paper, we present a fast portable executable (PE) malware detection system, which is based on the analysis of the set of Application Programming Interfaces (APIs) called by a program and some technical PE features (TPFs). We used an efficient feature selection method, which first selects the most relevant APIs and TPFs using the chi-square (KHI²) measure, and then the Phi (?) coefficient was used to classify the features in different subsets, based on their relevance. We evaluated our method using different classifiers trained on different combinations of feature subsets. We obtained very satisfying results with more than 98% accuracy. Our system is adequate for real-time detection since it is able to categorize a file (Malware or Benign) in 0.09 seconds

Article Statistics
Multiple requests among the same broswer session are counted as one view (or download).
If you mouse over a chart, a box will show the data point's value.


Cite this article
IEEE Style
Mohamed Belaoued and Smaine Mazouzi, "A Chi-Square-Based Decision for Real-Time Malware Detection Using PE-File Features ," Journal of Information Processing Systems, vol. 12, no. 4, pp. 644~660, 2016. DOI: 10.3745/JIPS.03.0058.

ACM Style
Mohamed Belaoued and Smaine Mazouzi, "A Chi-Square-Based Decision for Real-Time Malware Detection Using PE-File Features ," Journal of Information Processing Systems, 12, 4, (2016), 644~660. DOI: 10.3745/JIPS.03.0058.