Static analysis of executable files by machine learning methods

The paper describes how to detect malicious executable files based on static analysis of their binary content. The stages of pre-processing and cleaning data extracted from different areas of executable files are analyzed. Methods of encoding categorical attributes of executable files are considered, as are ways to reduce the feature field dimension and select characteristic features in order to effectively represent samples of binary executable files for further training classifiers. An ensemble training approach was applied in order to aggregate forecasts from each classifier, and an ensemble of classifiers of various feature groups of executable file attributes was created in order to subsequently develop a system for detecting malicious files in an uninsulated environment. Introduction In order to frustrate efforts to analyze malware and create signatures to identify viruses, the latest viruses are using polymorphism and metamorphism on an increasingly frequent basis. This means that the number of variations within malware families is constantly growing, which poses a serious problem for the developers of antivirus products. Approaches based on searching for signatures in files are no longer effective. They are being replaced by the dynamic analysis of malicious code in an isolated environment [1], as well as the use of various heuristic detection methods [2]. This paper proposes a method for detecting malicious portable executable (PE) files on Windows operating systems based on the static analysis of their binary contents. This operating system has been chosen due to it immense popularity, which inevitably results in a large number of malicious files being created specifically for this OS.