Identifying Malware through Static and Dynamic Analysis

• Given: The static analysis data consisted of opcodes, structure, string files whereas the dynamic analysis data consisted of json files which were compiled using cuckoo. The files given were classified into Malware and Benign depending on the various properties, structure, features of the files.
• Task: To do feature engineering and apply Machine Learning algorithms to classify the files as Malware or Benign.
• For static analysis: Extracted the features (information from Headers and APIs) and selected some of them using TFIDF. Fed the features to Ensemble of Trees for binary classification.
• For dynamic analysis: Extracted the features (DllLoaded, Summary, ApiStats, NetworkCalls etc.) and eliminated the ones with Zero-importance. Fed the features to Random Forest for binary classification.
• This was done as a part of course CS698M instructed by Prof. Sandeep Shukla.