Malware Detection Based on Term Frequency Analysis of GPRs Features

Recently, low-level hardware micro-architecture features are widely used for malware detection, but they always have redundant information, which will inevitably affect malware detection. To address the above problem, this paper proposed a novel dynamic analysis method to detect malware. The feature matrices are first extracted from the General-Purpose Registers (GPRs) that contain a large amount of valuable but redundant information. To reduce the feature dimension, Term Frequency-Inverse Document Frequency (TF-IDF) technique is then used to select the discriminative information from feature matrices. With the selected features, this paper also designs an ensemble learning model for malware detection. Experimental results show that the proposed method performs better than other state-of-art methods.