Malware detection using Gini, Simpson diversity, and Shannon-Wiener indexes

Abstract

The increasing number of malware attacks poses a significant challenge to cyber security. This paper proposes a methodology for static malware analysis using biodiveristy-inspired metrics that is Gini coefficient, Simpson diversity, and Shannon-Wiener index for malware detection. These metrics are used to build the structural feature representation on the raw binary file as the feature space. The effectiveness of these metrics are evaluated using multilayer perceptron (MLP) neural network and extreme gradient boosting (XGBoost) models. A deterministic algorithm is used to generate these features that represent the feature signature of the executable file. Additionally, we investigated the effectiveness of different byte sizes as the input feature for these two classifiers. According to the results, Gini coefficient with on chunk size of 128 has successfully achieved average F1 score of more than 98.7% by using XGBoost model.