Building Contemporary and Efficient Static Models for Malware Detection

Malware detection capabilities have grown as the sophistication of the attacks has increased. Usually, signature databases are used to identify malicious files. Due to the growing size of these databases and the constant need for updating, most security vendors have started using static models to detect malicious content. These models work with excellent accuracy initially but fail to provide the desired output efficiently in the long run. In this research, we explore a different approach where instead of trying to identify all malware with thousands of attributes with a single model, we propose a smaller set of attributes to detect malware as a first gate before scanning unidentified files with a larger model. By using a smaller set of attributes, we believe we can reduce the processing workload on an endpoint by reducing the number of files required to extract thousands of attributes. If we filter out a subset of files before they need to extract those attributes, we can reduce the resources required on the endpoint. We also look at how to keep our model up to date. We use an updated source that always contains new malware samples and also extracts the features that we have used in our model. Using VirusTotal [4], we obtain thousands of reports on various malicious files. Through validation testing, we have demonstrated that our model works with 97% accuracy.