Machine Learning for Windows Malware Detection and Classification: Methods, Challenges and Ongoing Research

Abstract

In this chapter, readers will explore how machine learning has been applied to build malware detection systems designed for the Windows operating system. This chapter starts by introducing the main components of a Machine Learning pipeline, highlighting the challenges of collecting and maintaining up-to-date datasets. Following this introduction, various state-of-the-art malware detectors are presented, encompassing both feature-based and deep learning-based detectors. Subsequent sections introduce the primary challenges encountered by machine learning-based malware detectors, including concept drift and adversarial attacks. Lastly, this chapter concludes by providing a brief overview of the ongoing research on adversarial defenses.

References in corpus (10)

• XGBoost: A Scalable Tree Boosting System
• Microsoft Malware Classification Challenge
• Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning
• Functionality-preserving Black-box Optimization of Adversarial Windows Malware
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Fusing Feature Engineering and Deep Learning: A Case Study for Malware Classification
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection
• Query-Free Evasion Attacks Against Machine Learning-Based Malware Detectors with Generative Adversarial Networks