Short Paper: Machine Learning-Based Secure Malware Detection Using Features from Binary Executable Headers.

As the number of intelligent systems has dramatically increased, malware has become increasingly harmful. Consequently, detecting previously unknown malware swiftly has emerged as a critical issue in cybersecurity, aiming to prevent these threats from becoming widespread hazards that harm users and systems. To address this challenge, machine learning methods have been employed to rapidly detect and classify malware. These methods can be either dynamic or static analysis. Dynamic analysis allows for the collection of significant features not obtainable through static analysis alone. However, malware authors often employ techniques to evade automated malware analysis, leading to decreased true detection rates due to sandbox evasion strategies. In this study we focus on static analysis for malware detection, specifically on Portable Executable (PE) files. For this purpose, we propose a novel feature extraction pipeline, and a methodology aimed at finding reliably secure detectors, where the main priority is to avoid at all cost false negatives. For this, we leverage the use of the AutoML (auto-sklearn) framework and perform a reliability analysis of different configurations after consequently setting the working points to avoid false negatives. Our experiments, performed using the up-to-date MalwareBazaar malware dataset, show that it is possible to find consistently robust ML detectors when using the proposed static feature sets for PE files.