Malware Detection Through Memory Analysis

TL;DR

This study demonstrates that machine learning, specifically XGBoost, can effectively and efficiently detect malware using memory analysis data, achieving near-perfect accuracy in binary classification and high speed for real-time applications.

Contribution

The paper evaluates XGBoost for malware detection using memory analysis, showing its high accuracy and speed, advancing real-time cybersecurity defenses.

Findings

Binary classifier accuracy: 99.98%

Multi-class accuracy: 87.54%

Classification speed: ~37-43 milliseconds for 50 samples

Abstract

This paper summarizes the research conducted for a malware detection project using the Canadian Institute for Cybersecurity's MalMemAnalysis-2022 dataset. The purpose of the project was to explore the effectiveness and efficiency of machine learning techniques for the task of binary classification (i.e., benign or malicious) as well as multi-class classification to further include three malware sub-types (i.e., benign, ransomware, spyware, or Trojan horse). The XGBoost model type was the final model selected for both tasks due to the trade-off between strong detection capability and fast inference speed. The binary classifier achieved a testing subset accuracy and F1 score of 99.98\%, while the multi-class version reached an accuracy of 87.54\% and an F1 score of 81.26\%, with an average F1 score over the malware sub-types of 75.03\%. In addition to the high modelling performance, XGBoost is also efficient in terms of classification speed. It takes about 37.3 milliseconds to classify 50 samples in sequential order in the binary setting and about 43.2 milliseconds in the multi-class setting. The results from this research project help advance the efforts made towards developing accurate and real-time obfuscated malware detectors for the goal of improving online privacy and safety. *This project was completed as part of ELEC 877 (AI for Cybersecurity) in the Winter 2024 term.