# Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis
## 5 Conclusions  
This study developed an effective and reliable approach that can be implemented in classifying malicious files at the end-user computer. The purpose of this research is to increase the detection accuracy of malware and reduce false positive rates. Based on the experiments, it was proved that adding more related features from the memory to features extracted from dynamic analysis enhances the detection accuracy. In addition, the proposed approach overcomes the limitation of one path of execution in dynamic analysis by looking for extra features in the memory that did not appear in the dynamic analysis, which might reveal a hidden part of malware and, therefore, improves the performance of the proposed detection approach. Our work and experiments have focused on Windows operating system as it is the most targeted operating system by malware campaigns. The proposed approach is comprehensive and consistent. It collects memory artifacts using memory forensics tools in addition to features extracted during the execution of malicious files through dynamic analysis. The malware data set consisted of malware downloaded from two sources and they were captured in different periods of time. Moreover, the data set contained an equal quantity of malware that represent Adware, Ransomware, Keylogger, Downloader and Backdoor families. After the completion of the features engineering process, the features were used in training and testing the classifier. A 10-fold cross validation was applied to evaluate the proposed approach by applying the following machine learning algorithms: The support vector machine (SVM), the decision tree, Naive Bayes, K-nearest neighbor (KNN) and the random forest. The results show a significant improvement using SVM in the detection accuracy rate and a noteworthy decrease in false positive rates of 98.5% and 1.7% respectively. In this work, only API call features were extracted from the memory images and dynamic analysis, and used in the classification process. Although API calls achieved a high classification result. However, other features, like the registry and networking features, are to be considered for improving the proposed approach in future work. The proposed approach can be improved by increasing the \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \# & **Feature** & **Freq** & **\%** & **\#** & **Feature** & **Freq** & **\%** \\ \hline
1 & RtlEncodePointer & 630 & 52.5 & 11 & UnhandledExceptionFilter & 319 & 26.6 \\
2 & RtlDecodePointer & 630 & 52.5 & 12 & GetCurrentProcessId & 317 & 26.4 \\
3 & RtlExitUserThread & 573 & 47.8 & 13 & GetDC & 314 & 26.2 \\
4 & GetLastError & 360 & 30 & 14 & TerminateProcess & 314 & 26.2 \\
5 & GetProcAddress & 348 & 29 & 15 & HeapAlloc & 313 & 26.1 \\
6 & FreeLibrary & 345 & 28.8 & 16 & HeapFree & 313 & 26.1 \\
7 & GetCurrentProcess & 337 & 28.1 & 17 & QueryPerformanceCounter & 313 & 26.1 \\
8 & WideCharToMultiByte & 337 & 28.1 & 18 & EnterCriticalSection & 312 & 26 \\
9 & MultiByteToWideChar & 327 & 27.3 & 19 & LeaveCriticalSection & 312 & 26 \\
10 & GetCurrentThreadId & 323 & 26.9 & 20 & WriteFile & 312 & 26 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The 20 most prominent features appearing in the memory analysis. number of malware in the data set as well. Furthermore, more works are required to enhance the abilities of the sandbox environments against malware anti-forensics and anti-virtualization techniques. Conceptualization, R.S., K.O. and K.A.Z.A. ; Formal analysis, R.S., K.O. and K.A.Z.A. ; Methodology, R.S., K.O., K.A.Z.A. and S.A.A. ; Resources, R.S. ; Supervision, K.O. and K.A.Z.A. ; Visualization, R.S. ; Writing--original draft, R.S. ; Writing--review & editing, R.S., K.O., K.A.Z.A. and S.A.A. ; Project administration, R.S., K.O. and K.A.Z.A. This research was funded by Deanship of Scientific Research at King Faisal University. The authors acknowledge the Deanship of Scientific Research at King Faisal University for the financial support under Nasher Track (Grant No. 186256).