Malware Detection Module using Machine Learning Algorithms to Assist in Centralized Security in Enterprise Networks

TL;DR

This paper presents a machine learning-based malware detection system that analyzes system API calls to identify and rank potential threats, enhancing enterprise network security beyond traditional signature-based methods.

Contribution

It introduces a novel antivirus engine that classifies files using API call patterns and machine learning, providing a more proactive security solution for enterprises.

Findings

Effective detection of malware through API call analysis

Improved security risk ranking of files

Centralized system enhances enterprise protection

Abstract

Malicious software is abundant in a world of innumerable computer users, who are constantly faced with these threats from various sources like the internet, local networks and portable drives. Malware is potentially low to high risk and can cause systems to function incorrectly, steal data and even crash. Malware may be executable or system library files in the form of viruses, worms, Trojans, all aimed at breaching the security of the system and compromising user privacy. Typically, anti-virus software is based on a signature definition system which keeps updating from the internet and thus keeping track of known viruses. While this may be sufficient for home-users, a security risk from a new virus could threaten an entire enterprise network. This paper proposes a new and more sophisticated antivirus engine that can not only scan files, but also build knowledge and detect files as potential viruses. This is done by extracting system API calls made by various normal and harmful executable, and using machine learning algorithms to classify and hence, rank files on a scale of security risk. While such a system is processor heavy, it is very effective when used centrally to protect an enterprise network which maybe more prone to such threats.