Malware Classification and Detection using Variations of Machine Learning Algorithm Models

Malware attacks are attacks carried out by an attacker by sending malicious codes to various files or even many packages and servers. Therefore, reliable network operations are a factor that needs to be considered to prevent attacks as early as possible in order to avoid more severe system damage. Types of attacks can be Ping of Death, flooding, remote-controlled attacks, UDP flooding, and Smurf Attacks. Attack data was obtained from the ClaMP dataset, which has an unbalanced data set, and has very high noise, so it is necessary to analyze data packets in network logs and optimize feature extraction which is then analyzed statistically with machine learning algorithms. The purpose of the study is to detect, classify malware attacks using a variety of ML Algorithm models such as SVM, KNN and Neural Network and testing detection performance. The research stage starts from pre-Processing, extraction, feature selection and classification processes and performance testing. Training and testing data in the study used a mixed model, namely data division, split model and cross validation. The results of the study concluded that the best algorithm for detecting malware packages is the Neural Network for the Feature Combination category with an accuracy rate of 96.91%, Recall of 97.35% and Precision of 96.78%. So that the study can have implications for cyber experts to be able to prevent malware attacks early. While further research requires a special algorithm to improve malware attack detection, in addition to KNN, SVM and Neural Network. And another research challenge is to focus on feature extraction techniques on datasets that have unbalanced or varied features with the Natural Language Processing (NLP) approach. So this research can be used as a reference for researchers who are conducting research in the same field.