IMA- An Intelligent Obfuscated Malware Analysis Model

In the dominion of cyber-world and cybersecurity, the pervasive presence of the malware, exchanging vast amounts of data daily, has inflicted considerable harm globally, victimizing millions. Among the various manifestations of malware, obfuscation presents a unique challenge, often eluding traditional detection methods and persisting in the real world. Despite substantial efforts in this domain, existing works exhibit room for advancement, particularly with recent extensions. However, both of these existing classification methods are yet to be applied in a hybrid classification model. This work proposes a novel hybrid obfuscated malware detection model called IMA (Improved Machine-Aided) using a stacked ensemble learning process. The first layer employs the conventional machine learning processes and algorithms, i.e. Random Forest, Extreme Gradient Boosting (XgBoost) Classifier, and Extremely Randomized Trees Classifier (ExtraTrees), whereas a deep learning layer refines the classification. Feature selection is done by using Pearson correlation analysis for better efficiency. Selection of an optimal feature subset optimises the classification accuracy of the model. Specifically, for the multiclass classification, the time complexity is improved by more than two times, and in the binary classifications, by more than three times. Performance evaluation is carried out on the publicly available obfuscated malware classification dataset from CIC-MaIMem-2022. The results demonstrated that the proposed IMA model could outperform other classifications.