Adaptive Malware Detection through Portable Executable Header Analysis and Hybrid Machine Learning

Abstract

Conventional signature dependent detection mechanisms have lost their effectiveness due to the evolution of malware and the growing deployment of obfuscation and structural changes of executable files to make the detection process more difficult, thus there was a need for efficient and adaptive mechanisms that can detect malformed executables based on their intrinsic structural properties. An adaptive malware detection framework based on portable executable (PE) header analysis, discriminative feature selection, hybrid machine learning, and adaptive model updating was proposed in this study for reliably classifying benign and malicious executable files. Firstly, relevant PE attributes are extracted, such as section count, entry point, image size, code size, DLL characteristics, section characteristics, subsystem information, import count, file alignment, and section alignment. The selected attributes are then standardized and assessed to build an optimized feature representation that was then fed into complementary Support Vector Machine (SVM), Random Forest (RF), and Extreme Gradient Boosting (XGBoost) classifiers. A hybrid decision-making mechanism was used to enhance classification robustness by the complementary predictions. By combining the three configurations of classification, the proposed approach was found to have an accuracy of 98.8%, a precision score of 98.6%, a recall score of 98.9%, an F1 score of 98.7%, and an ROC-AUC score of 0.995, which was superior to the evaluated classification configurations in terms of accuracy, precision, recall, and F1-score. The adaptive evaluation model outperforms the static model on the attribute changes in the executable properties: At the last update stage, the F1-score of the adaptive hybrid model was 98.8%, while that of the static model was 91.8%. The results show that structural PE analysis, coupled with other machine-learning models and adaptive updating, can yield accurate and more robust malware detection results in the context of changing distributions of executables. It presents a scalable architecture for the screening of static malware and ongoing model updates in dynamic cybersecurity scenarios.