| Abstract [eng] |
The master’s thesis intends to investigate the features of obfuscated malware to mislead machine learning models to recognize malware. Literature analysis reveals and analyses the characteristics of obfuscated and non-obfuscated malware identified by other authors. The attributes are then categorized. Three main types of analysis of such software are distinguished based on the features identified: static, dynamic and hybrid. Based on the literature analysis, two main attributes for malware identification have been identified: application programming interfaces and program executables. The thesis experiment examines what features determine that malware is obfuscated. To conduct the experiment, three machine learning algorithms are used: random forest classifier, gradient boosting classifier and multi-layer perceptron. Two models were also developed: a sequential model and a combined voting model. Two similar datasets were selected to evaluate the algorithms and models: “EMBER 2018” and “EMBER 2024.” Gradient boosting classifier and the sequential model misclassify obfuscated malware – failing to detect 40, 44 percent and 44,58 percent of all samples, respectively. Random forest classifier and multilayer perceptron correctly classify obfuscated malware (failing to detect 27,78% and 17,72% of all samples, respectively), identify its features. Combining them into a combined voting model results in even better performance – 14,52 percent. An importance analysis of obfuscated malware features revealed that the features identified during the literature review coincide with those identified in the experimental study: section information (of executable programs), import functions (Application programming interface), and program parse warnings, which allow for the detection of anomalies in obfuscated programs. |
