MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm

Palša, Jakub; Ádám, Norbert; Hurtuk, Ján; Chovancová, Eva; Madoš, Branislav; Chovanec, Martin; Kocan, Stanislav

doi:10.3390/app12136672

Open AccessArticle

MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm

by

Jakub Palša

^*

,

Norbert Ádám

,

Ján Hurtuk

,

Eva Chovancová

,

Branislav Madoš

,

Martin Chovanec

and

Stanislav Kocan

Department of Computers and Informatics, Faculty of Electrical Engineering and Informatics, Technical University of Košice, Letná 9, 042 00 Kosice, Slovakia

^*

Author to whom correspondence should be addressed.

Appl. Sci. 2022, 12(13), 6672; https://doi.org/10.3390/app12136672

Submission received: 1 June 2022 / Revised: 15 June 2022 / Accepted: 28 June 2022 / Published: 1 July 2022

(This article belongs to the Section Computing and Artificial Intelligence)

Download

Browse Figures

Versions Notes

Abstract

This paper focuses on training machine learning models using the XGBoost and extremely randomized trees algorithms on two datasets obtained using static and dynamic analysis of real malicious and benign samples. We then compare their success rates—both mutually and with other algorithms, such as the random forest, the decision tree, the support vector machine, and the naïve Bayes algorithms, which we compared in our previous work on the same datasets. The best performing classification models, using the XGBoost algorithm, achieved 91.9% detection accuracy and 98.2% sensitivity, 0.853 AUC, and 0.949 F1 score on the static analysis dataset, and 96.4% accuracy and 98.5% sensitivity, 0.940 AUC, and 0.977 F1 score on the dynamic analysis dataset. Then, we exported the best performing machine learning models and used them in our proposed MLMD program, automating the process of static and dynamic analysis and allowing the trained models to be used for classification on new samples.

Keywords: malware; classification; static analysis; dynamic analysis; supervised machine learning; cybersecurity

Share and Cite

MDPI and ACS Style

Palša, J.; Ádám, N.; Hurtuk, J.; Chovancová, E.; Madoš, B.; Chovanec, M.; Kocan, S. MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm. Appl. Sci. 2022, 12, 6672. https://doi.org/10.3390/app12136672

AMA Style

Palša J, Ádám N, Hurtuk J, Chovancová E, Madoš B, Chovanec M, Kocan S. MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm. Applied Sciences. 2022; 12(13):6672. https://doi.org/10.3390/app12136672

Chicago/Turabian Style

Palša, Jakub, Norbert Ádám, Ján Hurtuk, Eva Chovancová, Branislav Madoš, Martin Chovanec, and Stanislav Kocan. 2022. "MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm" Applied Sciences 12, no. 13: 6672. https://doi.org/10.3390/app12136672

APA Style

Palša, J., Ádám, N., Hurtuk, J., Chovancová, E., Madoš, B., Chovanec, M., & Kocan, S. (2022). MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm. Applied Sciences, 12(13), 6672. https://doi.org/10.3390/app12136672

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Menu

MLMD—A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm

Abstract

Share and Cite

Article Metrics

Article Access Statistics

Further Information

Guidelines

MDPI Initiatives

Follow MDPI