This project is my attempt to apply machine learning to static malware analysis with a goal of identifying interesting files that should be examined further during an investigation.
Here are some of the features I want to use in examining the executables:
- Number of PE sections
- Names of PE sections
- Entropy of PE sections
- DLL imports
- Function imports
- distribution of x86 instructions
It might be necessary to have features such as "More than 5 PE sections" to run the analysis. Where would the number 5 come from? I'll need to do some research prior to the machine learning to find out what is normal for malware and what is normal for benign files?
- pefile: is a python library for identifying the pe sections of a file.
- distorm: python disassembler
- http://blog.breakinsecurity.com/parsing-the-portable-executable-pe-file-format-with-pefile/
- https://code.google.com/p/distorm/
- http://stackoverflow.com/questions/2185862/entropy-in-txt-file
- http://hal.archives-ouvertes.fr/docs/01/05/63/87/PDF/cms2010_submission_37.pdf
- http://www.hindawi.com/journals/tswj/2014/260905/
- http://virusshare.com/
- http://malshare.com/index.php