[Paper Review] Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification

Mansour Ahmadi, Dmitry Ulyanov+3 more|arXiv (Cornell University)|Nov 13, 2015

Advanced Malware Detection Techniques28 references4 citations

TL;DR

This paper proposes a lightweight, high-accuracy malware family classification system that extracts novel structural features from portable executable (PE) files without unpacking or deobfuscating malware. By fusing content-based and statistical features using a per-class weighting strategy and XGBoost with bagging, the method achieves 99.8% accuracy on the Microsoft Malware Classification Challenge dataset, outperforming complex models with significantly lower computational cost.

ABSTRACT

Modern malware is designed with mutation characteristics, namely polymorphism and metamorphism, which causes an enormous growth in the number of variants of malware samples. Categorization of malware samples on the basis of their behaviors is essential for the computer security community, because they receive huge number of malware everyday, and the signature extraction process is usually based on malicious parts characterizing malware families. Microsoft released a malware classification challenge in 2015 with a huge dataset of near 0.5 terabytes of data, containing more than 20K malware samples. The analysis of this dataset inspired the development of a novel paradigm that is effective in categorizing malware variants into their actual family groups. This paradigm is presented and discussed in the present paper, where emphasis has been given to the phases related to the extraction, and selection of a set of novel features for the effective representation of malware samples. Features can be grouped according to different characteristics of malware behavior, and their fusion is performed according to a per-class weighting paradigm. The proposed method achieved a very high accuracy ($\approx$ 0.998) on the Microsoft Malware Challenge dataset.

Motivation & Objective

• To address the challenge of classifying polymorphic and metamorphic malware variants efficiently without deobfuscation or unpacking.
• To design a compact yet discriminative set of structural features that capture intrinsic PE file characteristics for improved classification.
• To achieve high classification accuracy while minimizing computational complexity for industrial deployment.
• To enable interpretable malware classification by reducing feature set size compared to complex models.
• To evaluate the robustness and practicality of the system in real-world anti-malware scenarios.

Proposed method

• Extracts content-based features such as byte code n-grams, operation code n-grams, and API call sequences from malware samples.
• Proposes novel statistical features reflecting the structural layout of PE files, including entropy and distribution patterns of sections and headers.
• Applies a forward stepwise feature selection algorithm to identify the most relevant feature categories, balancing accuracy and feature count.
• Fuses features using a per-class weighting paradigm to emphasize family-specific discriminative signals.
• Employs XGBoost with bagging as the classifier, favoring efficiency and robustness over complex ensemble architectures.
• Avoids unpacking and deobfuscation by relying solely on static analysis of raw binary and disassembled code.

Experimental results

Research questions

• RQ1 Can novel structural features of PE files improve malware family classification accuracy without requiring unpacking or deobfuscation?
• RQ2 How does the fusion of diverse feature types—content-based and structural—impact classification performance?
• RQ3 What is the trade-off between feature set size and classification accuracy in malware family classification?
• RQ4 How does the proposed method compare in performance and complexity to state-of-the-art approaches, particularly the winning solution of the Microsoft Malware Challenge?
• RQ5 To what extent is the system robust against evasion or poisoning attacks, given its design for classification rather than detection?

Key findings

• The proposed method achieved a classification accuracy of approximately 0.998 on the Microsoft Malware Classification Challenge dataset, matching the winning team’s result of 0.9983.
• The system achieved a logloss of 0.0028 on test data, indicating strong generalization and model calibration.
• The method demonstrated significantly lower computational complexity than the winning solution, which relied on resource-intensive n-gram features and complex ensembles.
• The use of novel structural features enabled effective classification of packed and obfuscated malware without unpacking, preserving performance.
• The forward feature selection process effectively reduced the number of features while maintaining high accuracy, enhancing interpretability.
• The system is well-suited for industrial deployment due to its balance of high accuracy and low computational cost.