Detection of Malware on Portable Executable Files Using Machine Learning

In recent years, attackers are very eager to find any vulnerability in the systems to deploy malware so that system can be infected very quickly. This research primarily focuses on malware detection on portable executable files by analyzing PE header, a technique that examines structural features of windows executable files to differentiate between malicious and benign files. The dataset taken for the research has a total number of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{1 3 8, 0 4 7}$</tex> in which <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{9 6, 7 2 4}$</tex> are malware and 41,323 are benign. During the pre-processing, important features are only selected which increases the efficiency of the model. By employing a machine learning model, Random Forest Classifier on a carefully selected set of twenty six features, the proposed method achieves an impressive accuracy of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{9 8} \%$</tex>. The model's performance has been rigorously evaluated using wellestablished metrics, including precision, recall, F1-score, and support, providing a comprehensive view of its effectiveness. This high level of accuracy, coupled with robust metric verification, demonstrates the reliability of using PE header characteristics for efficient and accurate malware detection, making it a promising approach for enhancing cybersecurity defenses.