Machine Learning Techniques for Classifying Malicious API Calls and N-Grams in Kaggle Data-set

Some malware variants have the ability to obfuscate and change their activities, which increases the difficulty for classifying their identity. Especially, when there is a lack of systematic analysis of their activities and signature patterns. Machine learning technology would be a promising approach for targeting these types of malware since it can learn new knowledge of unknown or new malware and can be trained to adopt such knowledge with artificial intelligence while it is applied on a system for monitoring and detecting incoming malware. In this research, we study the performances of several machine learning algorithms for classifying malware. Ten machine leaning algorithms are used to classify a Microsoft Kaggle data-set consisting of mainly nine malware families identified by their API calls and N-grams signature patterns. Our research results show that Random Forest machine learning algorithm is the best one for classifying the selected malware since it has the best overall performance metrics of True Positive Rate, F-Measure, Matthews Correlation Coefficient, and Receiver Operating Characteristic Area.