Optimized Malware Detection Framework Using Principal Components Analysis

Software that can damage an information system asset is considered a malware, such information systems have been rendered to several destructive attacks mainly due to the emergence of the Internet. Conventional Antimalware software is not effective at eliminating malware due to its many evasion techniques such as polymorphism and code obfuscation. Antimalware software is ineffectual and defenseless against zero-day attacks as it can only eliminate malware for which it has signatures. K Nearest Neighbor, Decision Tree and Support Vector Machine are some of the leading classifiers that has successfully detect and classify Malware but optimal accuracy of detection has not been achieved, in addition, false positives and false negatives persists because the hyperparameters of these classifiers were not optimized and noise was not filtered out of the datasets using feature selection technique. The aim of this research is to develop an optimized malware detection and classification framework employing Principal Components Analysis to mitigate the curse of dimensionality while utilizing optimal hyperparameters of chosen classifiers to boost accuracy of malware detection and classification as well as reduction of false positives and false negatives. This research employed K Nearest Neighbor, Decision Tree, and Support Vector Machine to detect and classify malware with CICMalmem dataset to train the model. Grid search optimization was combined with K-fold cross-validation to optimize the hyperparameters of the selected classifiers in order to boost the model's performance and achieve high detection accuracy as well as low false positives and low false negatives. Machine learning performance metrics such as the F1 Score, Precision, Recall, and Confusion Matrix were used to evaluate the Research Model. K Nearest Neighbor generated Zero False Positives while KNN, Decision Tree and Support Vector Machine achieved Accuracy of 99%, 98.64, and 100% respectively.