# Malicious File Detection Method Using Machine Learning and Interworking with MITRE ATT&CK Framework
## 4 Results
### App.Any.Run  
As shown in Figure 12, app.any.run, a representative service for automated malicious code analysis, is a program that analyzes the threat of malicious code files and normal files in detail. It provides results for various operating systems and office environments such as document-type malicious code and executable EXE malicious code. In addition, it supports many optional filter searches, and the Hunter version provides infinite API requests, allowing a user to quickly respond to security threats. The search filter function allows filtering based on hash information, character information included in the analysis function, and a specific script. In operating system filtering, it is possible to filter based only on the unwindowed version. From Windows XP to Windows 10, a search can be performed according to the operating system. Furthermore, it is possible to search by file type. If \"Scripts\" is selected, the VBA, VBE, BAT, and TXT file types are searched, and if \"Verdict not specified\" is selected below and then \"malicious\" is selected, only malicious code is searched. For the dynamic analysis of malicious code, a virtual environment (Windows 7 32 bit) was built, and a suspicious file (setup.exe) was executed and analyzed using the app.any.run system. Figure 13 shows the TCP Stream result data of the pcap file through the Wireshark program. The malicious file was analyzed using the Wireshark function provided by app.any.run. Based on the analysis, two malicious codes using the.cab extension and the URL of the distribution site were found in the setup.exe packet. The HTTP request packet analysis result data are shown in Table 6, and the network connection results are shown in Table 7. Table 8 shows the result of DNS Requests packet analysis. Table 9 lists the results of the modifications to the malicious files. \begin{table}
\begin{tabular}{c c c c c} \hline
**Classifiers** & **True Positive** & **True Negative** & **False Positive** & **False Negative** & **Accuracy** \\ \hline Random Forest & 99\% & 1\% & 0 & 100\% & 0.9939152\% \\ Adaboost & 98\% & 2\% & 0 & 100\% & 0.9849088\% \\ Gradient Boosting & 98\% & 2\% & 0 & 100\% & 0.9874924\% \\ \hline \end{tabular}
\end{table} 
Table 5: Accuracy results for top 3 classifiers: True Positive: normal file detection; False Positive: detection of normal files identified as malicious; False Negative: detection of malicious files identified as normal. Figure 12: Classification of malicious and normal files by operating system. Figure 13: Setup.ex malicious file packet analysis result. By mapping the dynamic analysis result file to TTP and the MITRE ATT&CK framework, we successfully visualized the data results for the attacker's attack form. The tactics of the suspicious files corresponded to five categories: execution, persistence, privilege escalation, defense evasion, and discovery. The data and risk for 10 techniques and 43 events were measured as one danger, warnings, and three other cases. One danger case was detected using the boot or logon autostart execution technique as a result of the technique details of persistence and privilege escalation tactics. The detection result of 39 warnings was obtained using the execution tactics' Windows management instrumentation and MITRE's command and scripting interpreter attack technology. The XSL script processing, file and directory permissions modification, and hide artifacts attack techniques of defense evasion tactics were detected. In the discovery tactics, it was detected that the query registry, system information discovery, and software discovery attack techniques were used, and the visualization of all the detected data results is shown in Figure 14.  
To verify the results of this study, an experiment was conducted by preparing data for a total of 51,960 files, comprising 2583 normal files, 49,376 malicious files, and 1 unknown file.