These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
This work addresses the challenge of malware classification using machine
learning by developing a novel dataset labeled at both the malware type and
family levels. Raw binaries were collected from sources such as VirusShare, VX
Underground, and MalwareBazaar, and subsequently labeled with family
information parsed from binary names and type-level labels integrated from
ClarAVy. The dataset includes 14 malware types and 17 malware families, and was
processed using a unified feature extraction pipeline based on static analysis,
particularly extracting features from Portable Executable headers, to support
advanced classification tasks. The evaluation was focused on three key
classification tasks. In the binary classification of malware versus benign
samples, Random Forest and XGBoost achieved high accuracy on the full datasets,
reaching 98.5% for type-based detection and 98.98% for family-based detection.
When using truncated datasets of 1,000 samples to assess performance under
limited data conditions, both models still performed strongly, achieving 97.6%
for type-based detection and 98.66% for family-based detection. For interclass
classification, which distinguishes between malware types or families, the
models reached up to 97.5% accuracy on type-level tasks and up to 93.7% on
family-level tasks. In the multiclass classification setting, which assigns
samples to the correct type or family, SVM achieved 81.1% accuracy on type
labels, while Random Forest and XGBoost reached approximately 73.4% on family
labels. The results highlight practical trade-offs between accuracy and
computational cost, and demonstrate that labeling at both the type and family
levels enables more fine-grained and insightful malware classification. The
work establishes a robust foundation for future research on advanced malware
detection and classification.