MaxVote Classifier-Based Diversified Ensemble Model for Identifying Malicious Activity with Few-Shot API Data

Cyber attacks have been widespread with the internet everywhere. Identifying the malicious activity that prevails before any attack has become hard. In this work, we explore the machine learning techniques for effectively identifying malicious activity before a malware attack. We have collected APIs by exe-cuting malware and benign applications on a sandbox. A dataset comprising API counts is derived from API calls extracted. This has been evaluated by a range of diverse models, including Logistic Regression, Support Vector Machine (SVM), Decision Trees(DT), Random Forest(RF), Multi-Layer Perceptron (MLP), Recurrent Neural Networks (RNN), Prototypical Networks (Pro-toNet), and Siamese Networks(SiaNet). An Ensemble model, a culmination of these classifiers, is also tested. The models were trained and tested using a stratified spilt of 70:15:15 with evaluation metrics model accuracy, precision, recall, F1-score, and ROCAUC. The results are promising, with the Ensemble model outperforming all the individual model classifiers, by achieving a 95% accuracy score with an excellent AUC. Diversified ensemble of linear, tree-based, probabilistic and advanced neural Networks such as Prototypical and Siamese networks have demonstrated their prowess in generalization across few-shot learning instances. The overall findings underscore the importance of incorporating few shot learning methods and deep learning techniques in improving the efficiency of malware detection with a limited dataset by strengthening against adversarial attacks.