Classifying Portable Executable Malware Using Deep Neural Decision Tree

Abstract

Despite the extensive use of malware technologies, malware detection is still a challenge today, especially with the daily cyber-attack barrage. Data analysis coupled with machine learning techniques is gaining popularity as one of the approaches deployed to address this issue. This paper proposed a new technique for classifying malware from a large Portable Executable file (PEFile) using a deep neural decision tree. Every node in a hybrid approach represents a neural network trained to identify a single output category using binary classification as a decision tree. The dataset used in this study includes both benign (7,196) and malicious (16,698) PE files with 14 features extracted from the PEFile headers. Precision is 0.88, Recall is 0.32, Matthew Coefficient Correlation (MCC) is 0.302, Area Under the Curve (AUC) Receiving Operating Characteristic (ROC) with an AUC value of 0.63, and Average Precision score of 0.69 was used to evaluate the classifier. The result shows that binary classifier can distinguish between two classes: (1) malware and (2) benign.