Comparison of feature selection and classification algorithms in identifying malicious executables

摘要: Malicious executables, often spread as email attachments, impose serious security threats to computer systems and associated networks. We investigated the use of byte sequence frequencies a way automatically distinguish malicious from benign executables without actually executing them. In series experiments, we compared classification accuracies over seven feature selection methods, four algorithms, variable lengths. found that single-byte patterns provided surprisingly reliable features separate benign. Between classifiers overall performance models depended more on choice classifier than method selection. Support vector machine (SVM) were be superior in terms prediction accuracy, training time, aversion overfitting.