# An effective approach for classification of advanced malware with high accuracy

**Authors:** Ashu Sharma, Sanjay K. Sahay  
**arXiv:** [1606.06897](https://arxiv.org/abs/1606.06897)  
**Date:** 2016-06-22  
**Summary page:** https://www.summarizepaper.com/en/paper/1606.06897v1/

## Key points

- The paper addresses the challenge of combating advanced malware, specifically metamorphic malware
- The authors propose a novel approach to detect advanced malware by analyzing opcodes in executable files
- Executables are grouped based on earlier studies showing that the difference in size between malware generated by popular kits is within 5 KB
- Thirteen classifiers were studied using N-fold cross-validation, with focus on the top five: Random forest, LMT, NBT, J48, and FT
- Detection accuracy of more than 96.28% for unknown malware was achieved using these classifiers
- Their approach achieves a detection accuracy of 97.95% using the Random forest classifier
- This paper presents a significant contribution to software/systems security by addressing the challenge of detecting metamorphic malware through opcode analysis and achieving high detection accuracy

## Summary

The paper titled "An effective approach for classification of advanced malware with high accuracy" by Ashu Sharma and Sanjay K. Sahay addresses the challenge of combating advanced malware, specifically metamorphic malware that changes its structure and code after each infection. The authors propose a novel approach to detect such advanced malware with high accuracy by analyzing the occurrence of opcodes (features) in executable files. The authors group the executables based on their earlier studies, which showed that the difference in size between any two malware generated by popular advanced malware kits (PS-MPC, G2, and NGVCK) is within 5 KB. They then study the performance of thirteen classifiers using N-fold cross-validation available in the machine learning tool WEKA. Out of these thirteen classifiers, the authors focus on the top five classifiers: Random forest, LMT, NBT, J48, and FT. They achieve a detection accuracy of more than 96.28% for unknown malware using these classifiers; this surpasses the maximum detection accuracy (95.9%) reported by Santos et al in 2013. Amongst these top five classifiers, their approach achieves a detection accuracy of 97.95% using the Random forest classifier; demonstrating its effectiveness in accurately detecting unknown advanced malware. This paper presents a significant contribution to software/systems security by addressing the challenge of detecting metamorphic malware through opcode analysis and achieving high detection accuracy with their novel approach.