Malware severely threatens cybersecurity through Portable Executable (PE) files. In this study, the performances of machine learning and deep learning models for malware detection are compared using static analysis features extracted from PE files. Tree-based ensemble models like Random Forest, XGBoost, LightGBM, and CatBoost, along with MLP, DNN, and 1D-CNN deep learning architectures, were trained on a dataset comprising 62,485 samples and 15 features. Experimental results proved that ensemble algorithms outperform deep learning models on low-dimensional tabular data. Among the models, Random Forest achieved the highest success with 99.65% accuracy and a 99.59% F1-score. This academic study demonstrates that lightweight and high-performance tree-based models offer a more efficient solution for malware detection compared to computationally expensive deep neural networks.
Gokay Mutlu, Neşe Rihani, E. Bayazit· Signal Processing and Commun...· 0 citations
The rapid growth of sophisticated malware, including polymorphic, metamorphic, and zero-day threats, has made traditional signature-based and heuristic detection methods increasingly insufficient in modern desktop computing environments. As cyber threats continue to evolve in both complexity and scale, the demand for intelligent and adaptive malware detection mechanisms capable of identifying previously unseen attacks has become more critical than ever. In this study, we propose a novel deep learning framework for three-dimensional malware image classification that utilizes visual representation learning to improve malware detection performance. The proposed framework converts raw malware binaries into three-dimensional grayscale and RGB image representations, allowing hidden structural and spatial patterns within malware samples to be analyzed more effectively. By transforming malware data into multi-dimensional visual forms, the proposed system facilitates the process of automatically learning hierarchical features by CNN through multi-dimensional visualization of malware binary codes. In addition, an optimization technique using Genetic Algorithms is implemented within this architecture to improve classification performance and stability. The proposed evolutionary algorithm performs an effective search process within the large parameter space of 3D-CNN, leading to the identification of models that facilitate learning. It is shown that multi-dimensional visualization of malware achieves improved classification performance. It can be concluded that the combination of three-dimensional malware visualization, deep learning, and genetic optimization is promising for the development of future intelligent malware detection tools.
Muharrem Aslantas, E. Bayazit, Buket Doğan et al.· Applied Sciences· 0 citations