Malware Detection Using Higher Order Statistical Parameters

Malware holds an important place in system performance degradation and information embezzling from the victim system. Most of the malware writers choose their path to reach the victim system through the internet, infected browsers, injected files, memory devices, etc., highly obscured malwares evade the automated tools installed in the victim. Once the victim system gets affected by the malware, executable processes are controlled by malware. In this paper, an algorithm has been developed to identify the malware using image processing. The malware detection process has three phases. In first phase, the files (.exe) are converted into a gray scale image. The binary values of corresponding files are converted into 8 - bit gray scale intensity value. The band pass frequency of gray scale image is computed in second phase. In the final phase, third and fourth order statistical parameter such as skewness and kurtosis are calculated at the each sub region of band pass frequency image. The region which has the highest skewness and kurtosis value is marked as the malware file. The detection performance of the proposed method has been evaluated by using 1300 portable executable files. The detection method has a true positive ratio of 93.33% with 0.1 false positives. Preliminary results indicate that the proposed algorithm is better than other conventional malware detection methods.