An Approach for Malware Detection by Analyzing its Functionalities

The effectiveness of current antivirus software is limited when it comes to quickly detecting zero-day malware, as they lack the specific signatures required for identification and evasion. To address this issue, a novel system has been developed using a dataset extracted from Kaggle and VirusShare, consisting of a total of 2,16,352 combined samples of malware and benign files. This system utilizes a Random Forest classification algorithm to effectively detect malicious files. To optimize the classification process, the implementation of anti-file extension obfuscation measures enhances its effectiveness. Introducing two additional phases, the first phase classifies the executable file, while the second phase focuses on identifying the level of access and the type of malware present within the file. These latter phases involve extracting and analyzing DLL file functionalities. The DLLs provide the advantage of promoting code reusability and improving efficiency by enabling multiple applications to share code and resources. Therefore analyzing DLL files offers greater insight into the underlying malware functionalities. By employing this unique approach, the system provides an efficient and effective method for analyzing executable files and detecting zero-day malware as well as antivirus evasion techniques