Detecting Malware on Windows OS Using AI Classification of Extracted Behavioral Features from Images

In this research, using dynamic analysis ten critical features were extracted from malware samples operating in isolated virtual machines. These features included process ID, name, user, CPU usage, network connections, memory usage, and other pertinent parameters. The dataset comprised 50 malware samples and 11 benign programs, providing a data for training and testing the models. Initially, text-based classification methods were employed, utilizing feedforward neural networks (FNN) and recurrent neural networks (RNN). The FNN model achieved an accuracy rate of 56%, while the RNN model demonstrated better performance with an accuracy rate of 68%. These results highlight the potential of neural networks in analyzing and identifying malware based on behavioral patterns. To further explore AI's capabilities in malware detection, the extracted features were transformed into grayscale images. This transformation enabled the application of convolutional neural networks (CNN), which excel at capturing spatial patterns. Two CNN models were developed: a simple model and a more complex model. The simple CNN model, applied to the grayscale images, achieved an accuracy rate of 70.1%. The more complex CNN model, with multiple convolutional and fully connected layers, significantly improved performance, achieving an accuracy rate of 88%. The findings from this research underscore the importance of dynamic analysis. By leveraging both text and image-based classification methods, this study contributes to the development of more robust and accurate malware detection systems. It provides a comprehensive framework for future advancements in cybersecurity, emphasizing the critical role of dynamic analysis in identifying and mitigating threats.

@article{Alhamedi2024,
  title     = {Detecting Malware on Windows OS Using AI Classification of Extracted Behavioral Features from Images},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {15},
  number    = {8},
  year      = {2024},
  publisher = {The Science and Information Organization},
  author    = {Nooraldeen Alhamedi and Kang Dongshik},
  doi       = {10.14569/IJACSA.2024.01508129},
  url       = {https://doi.org/10.14569/IJACSA.2024.01508129}
}