用内存分析数据，99.98%准确识别恶意软件
Malware Detection Through Memory Analysis
- 基于内存特征用XGBoost做二分类和多分类
- 二分类准确率99.98%，多分类平均F1达75.03%
- 模型推理快，每50样本仅需43毫秒
本文基于加拿大网络安全研究所的MalMemAnalysis-2022数据集，开展恶意软件检测研究。目标是评估机器学习在二分类（良性/恶意）及多分类（良性、勒索软件、间谍软件、木马）任务中的有效性与效率。最终选用XGBoost模型，在二分类任务中测试集准确率达99.98%，F1分数为99.98%；在多分类任务中准确率为87.54%，整体F1为81.26%，各恶意软件子类平均F1为75.03%。该模型兼具高检测能力与快速推理优势：二分类下每50样本耗时约37.3毫秒，多分类下约43.2毫秒。研究成果有助于推进精准、实时的混淆恶意软件检测，提升在线隐私与安全水平。
原文摘要 · Abstract (English)
This paper summarizes the research conducted for a malware detection project using the Canadian Institute for Cybersecurity's MalMemAnalysis-2022 dataset. The purpose of the project was to explore the effectiveness and efficiency of machine learning techniques for the task of binary classification (i.e., benign or malicious) as well as multi-class classification to further include three malware sub-types (i.e., benign, ransomware, spyware, or Trojan horse). The XGBoost model type was the final model selected for both tasks due to the trade-off between strong detection capability and fast inference speed. The binary classifier achieved a testing subset accuracy and F1 score of 99.98\%, while the multi-class version reached an accuracy of 87.54\% and an F1 score of 81.26\%, with an average F1 score over the malware sub-types of 75.03\%. In addition to the high modelling performance, XGBoost is also efficient in terms of classification speed. It takes about 37.3 milliseconds to classify 50 samples in sequential order in the binary setting and about 43.2 milliseconds in the multi-class setting. The results from this research project help advance the efforts made towards developing accurate and real-time obfuscated malware detectors for the goal of improving online privacy and safety. *This project was completed as part of ELEC 877 (AI for Cybersecurity) in the Winter 2024 term.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。