Effective Malicious Features Extraction and Classification for Incident Handling Systems

Each and every day, malicious software writers continue to create new variants,new innovation, new infection, and more obfuscated malware by using packing andencrypting techniques. Malicious software classification and detection play animportant role and a big challenge for cyber security research. Due to the increasingrate of false alarm, the accurate classification and detection of malware is a bignecessity issue to be solved.This research provides the classification system to differentiate malware frombenign and classify malicious types. This research contributes the Malicious SampleNames Extraction (MSNE) procedure and Naming Malicious Samples using theRegular Expression (NMS_RE) technique have been contributed to label the malicioussamples. This research also contributes the prominent Malware Feature ExtractionAlgorithm (MFEA) to point out the dominant features based on the generated reportfiles. The features are API, DLL, and PROCESS called by malicious and benignexecutables through automated analysis. During the experiments, data cleansing forextracted raw data, applying the n-gram technique, and representing and preparing themalicious dataset have been performed to provide the malware classification system.This research work makes use of two malicious datasets for malwareclassification. The Benign Malware Classification (BMC) dataset is used for binaryclass classification system to identify malicious or not and Benign Malware FamilyClassification (BMFC) dataset is used for multi-class classification system to identifymalware family. Chi-Square and Principal Component Analysis (PCA) featureselection methods have been applied in this system to select the best features.Classification algorithms like k-Nearest Neighbor (kNN), Random Forest (RF) andSupport Vector Classification (SVC) have been used for multi-class and binary classclassification. The proposed approach is able to classify the malicious and benignexecutable files effectively.This research work provides malware classification using Machine Learning(ML) classifiers. The findings from the experiment prove that the extracted API_DLLfeatures provide the best evaluation metrics in terms of accuracy, confusion matrix(CM), True Positive Rate (TPR), False Positive Rate (FPR), and Receiver OperatingCharacteristic (ROC) curve area