# Survey on the Usage of Machine Learning Techniques for Malware Analysis

**Authors:** Daniele Ucci, Leonardo Aniello, Roberto Baldoni  
**arXiv:** [1710.08189](https://arxiv.org/abs/1710.08189)  
**Date:** 2017-10-23  
**Summary page:** https://www.summarizepaper.com/en/paper/1710.08189v1/

## Key points

- Coping with the increasing complexity and volume of malware poses a significant challenge
- Machine learning techniques are commonly used to tackle this issue by automatically learning models and patterns behind malware complexity
- This survey provides an overview of how machine learning has been used in malware analysis, categorizing surveyed papers based on objectives, specific information about malware, and machine learning techniques employed
- Problems related to datasets used in previous works are highlighted
- The authors propose three desiderata for malware analysis benchmarks: labels according to specific objectives, balanced representation of different classes, and actively maintained and updated samples
- "Malware analysis economics" is introduced, considering tradeoffs between reducing time and space complexities or providing additional means (e.g., computing machines, storage) for maintaining high levels of accuracy
- Various machine learning algorithms such as rule-based classifiers, decision trees, random forests, and support vector machines have been utilized for malware analysis
- Overall, the summary provides a comprehensive overview of how machine learning has been applied in malware analysis and highlights important considerations regarding dataset quality and resource constraints.

## Summary

Coping with the increasing complexity and volume of malware poses a significant challenge. Machine learning techniques have emerged as a common approach in the literature to tackle this issue by automatically learning models and patterns behind malware complexity. This survey provides an overview of how machine learning has been used in the context of malware analysis, categorizing surveyed papers based on their objectives, the specific information about malware they use, and the machine learning techniques employed. The survey also highlights several problems related to the datasets used in previous works. To address these issues, the authors propose three desiderata for malware analysis benchmarks: labels according to specific objectives; balanced representation of different classes; and actively maintained and updated samples. Additionally, this survey introduces "malware analysis economics," which considers tradeoffs between reducing time and space complexities or providing additional means (e.g., computing machines, storage) to maintain high levels of accuracy. Various machine learning algorithms such as rule-based classifiers, decision trees, random forests, and support vector machines have been utilized for malware analysis. Overall, this summary provides a comprehensive overview of how machine learning has been applied in malware analysis and highlights important considerations regarding dataset quality and resource constraints in analyzing complex malware threats.