EAAI Journal 2024 Journal Article
Feature selection for packer classification based on association rule mining
- Rosana Veroneze
- Charles-Henry Bertrand Van Ouytsel
- Khanh Huu The Dam
- Axel Legay
Malware often uses packing, an obfuscation strategy, to bypass antivirus. Identifying and understanding packers is therefore essential for analyzing suspicious binary files. Proposed machine learning methods for packer classification use a wide range of features, but many of them are redundant or irrelevant. It leads to waste of computational resources, so minimizing such features without reducing the effectiveness of packer identification is essential to analyze the ever-growing number of malware. This paper presents a novel embedded feature selection method for packer classification named Feature Selection based on Associative Classification (FSbAC). FSbAC exploits established concepts of association rule mining, particularly associative classification. As a result, FSbAC can define important sets of features per each packer individually, not just for the entire dataset. This makes it possible to directly learn the characteristics of each packer, improving the knowledge of analysts against packing. It also allows the costs associated with feature extraction to be taken into account during the selection process, ensuring the efficiency of the selected feature set. Seven different classification algorithms were used to assess the performance of FSbAC against eight FS methods. The evaluation encompassed different scenarios of packer classification, employing both a synthetic dataset and real-world datasets. The performance of the FS methods was evaluated with and without the inclusion of byte features vulnerable to bypass by hackers. Our results indicate that FSbAC is efficient for packer classification and leads to a substantial decrease in the number of features and in the computational resources required, without compromising predictive performance.