Malware detection based on opcode frequency

Abstract

Malware is a computer program or a piece of software that is designed to penetrate and detriment computers without owner's permission. There are different malware types such as viruses, rootkits, keyloggers, worms, trojans, spywares, ransomware, backdoors, bots, logic bomb, etc. Volume, Variant and speed of propagation of malwares are increasing every year. Antivirus companies are receiving thousands of malwares on the daily basis, so detection of malwares is complex and time consuming task. There are many malwares detection techniques like signature based detection, behavior based detection and machine learning based techniques, etc. The signatures based detection system fails for new unknown malware. In case of behavior based detection, if the antivirus program identify attempt to change or alter a file or communication over internet then it will generate alarm signal, but still there is a chance of false positive rate. Also the obfuscation and polymorphism techniques are hinderers the malware detection process. In this paper we propose new method to detect malwares based on the frequency of opcodes in the portable executable file. This research applied machine learning algorithm to find false positives, false negatives, true positives and true negatives for malwares and got 96.67 per cent success rate.