Malware classification using SVM and XGBoost: A study of the influence of features

Abstract

Zero-day malware shows a significant cybersecurity threat due to its ability to avoid traditional antivirus detection. This study investigates the application of machine learning techniques to detect and classify such advanced threats. Specifically, two well-known machine learning classifiers: Support Vector Machine (SVM) and XGBoost, to classify malware in a static analysis environment. The data was collected from the Kaggle platform and includes 5212 samples containing 70 features extracted from PE (Portable Executable) headers, including features from the DOS Header, PE Header, and Optional Header. The samples include both malicious and healthy files, and ten-fold cross-validation was used. The performance of the classifiers was evaluated using metrics such as accuracy, recall, F1 score, Roc curve and positive precision.

The results demonstrate XGBoost's performance was superior with an accuracy of about 99%, while SVM's accuracy was about 96%. XGBoost shows its high effectiveness and low error rate, which enhances its potential to be used as an effective tool in detecting zero-day malware and improving cyber security capabilities to detect unknown threats.