Malware Detection System: Safeguarding Against Evolving Threats

The term "malware in PE (Portable Executable) files" describes malicious code that is included into executable files and is used to take advantage of security holes in Windows-based systems. The .exe, .bat and .dll extensions of these programs include virus’s, worm’s ransomware or spyware which initiate illegal actions such as data theft, system interruption or unauthorized network access. Attackers often use a variety of evasion strategies such as encryption or code obfuscation and distribution strategies including phishing exploit kits, stolen software downloads or exploit PE malware has the ability to alter system processes, turn off security mechanisms or create persistence for sustained control when it is run. The main concepts of detection and mitigation include the use of behavioural analysis sandboxing or antivirus software to detect and stop dangerous activity before it compromises systems. Malware detection techniques have evolved to tackle the growing cyber threats, especially those of executable formats like EXE, DLL, and BAT. Traditional approaches, like the signature-based, behaviour-based detection methods, face significant limitations. Signature-based detection depends on matching the known malware patterns, making it ineffective for zero-day threats and newly developed variants, it needs frequent updates of the malware database to prevent the attacks from happening. Behaviour based detection monitors the file activities at runtime but it is resource-intensive and typically detects threats after partial execution, thereby increasing the risk of malware attacks. The detection through machine learning stands more accurate but depends on costly datasets, and it is vulnerable to adversarial attacks.This paper introduces a methodology that combines static analysis with machine learning for better detection of malware in executable files. It achieves the limitations of the traditional methods by analysing static features such as PE headers, section details, and entropy values etc. The model ensures accurate detection of known and unknown malware and operates without internet. This approach is scalable, resource efficient, and robust in addressing most of the contemporary malware detection challenges.