A static detection method for malware with low false positive rate for packed benign software

Abstract

Packing technology is commonly used in malicious software. With the increasing awareness of software publishers on their own intellectual property protection, the phenomenon of packing benign software is becoming more and more common. This phenomenon leads to a high false positive rate in traditional machine learning-based malware identification results. Traditional researches on malware detection based on machine learning focus on improving the identification accuracy of malware, and there are few researches on reducing the false positive rate. This article focuses on this issue. We select the data set that labels whether benign software is packed or not, and use a variety of machine learning algorithms to conduct experiments. Finally, we obtain the method with the lowest false positive rate. The experimental results show that the comprehensive index of the Extra-Trees algorithm is optimal.