Opcode and N-Gram Based Malware Classification

Malwares are programs that perform unwanted behaviors on computer systems. There are many types of malwares, such as keylogger, ransomware, rootkit, backdoor and trojan horse. These programs are constantly developing and increasing in number. For these reasons, the detection and classification of malware is an area of interest for researchers. Signature-based methods were used at first for the detection and classification of malicious software. However, with the development of malware over time, these methods have lost their function. With the development of static and dynamic detection methods, many parameters began to be used in the detection and classification of malware. In this study, opcode and N-Gram sequences which are static detection and classification methods were used. Firstly, the frequencies of opcode and N-Gram sequences were calculated. Then these two sequences were reduced and combined by the entropy-based knowledge gain method. The resulting new feature vectors were classified using classification algorithms. Accuracy rates of up to 99% were achieved in the classification results.