Static malware detection of Ember windows-PE API call using machine learning Available to Purchase

In recent years, the rise in computer threats, especially malware attacks, has led to research on various ways to detect and contain malware attacks. Malware detection approaches can be static, dynamic, or hybrid. Windows portable Executable (WPE) is the file format used by Microsoft windows for an executable file. Previous work based on static features of WPE provides acceptable accuracy, but it can't detect and judge malicious behavior during the execution of malware. This study utilized the EMBER dataset consisting of labeled benign and malicious samples of WPE files. Features based on API import calls are used to predict malicious and benign behavior of WPE files. The random forest, XGBoost, and LightGBM are applied over the collected dataset consisting of 1000 API call features of 1.55 million samples. Chi-Square and Gini importance-based feature selection techniques are used to find the top 200 features, whereas further machine learning models are trained over different feature subsets. Models trained over features selected using hybrid feature selection performed better than Chi-square-based feature selection. All models are analyzed and evaluated using standard performance measures where random forest outperformed with the accuracy of 90 using 150 features.