###### Abstract  
In previous years, cybercriminals have utilized various strategies to evade identification, including obfuscation, confusion, and polymorphism technology, resulting in an exponential increase in the amount of malware that poses a serious threat to computer security. The use of techniques such as code reuse, automation, etc., also makes it more arduous to identify variant software in malware families. To effectively detect the families to which malware belongs, this paper proposed and discussed a new malware fusion feature set and classification system based on the BIG2015 dataset. We used a forward feature stepwise selection technique to combine plausible binary and assembly malware features to produce new and efficient fused features. A number of machine-learning techniques, including extreme gradient boosting (XGBoost), random forest, support vector machine (SVM), K-nearest neighbors (KNN), and adaptive boosting (AdaBoost), are used to confirm the effectiveness of the fusion feature set and malware classification system. The experimental findings demonstrate that the XGBoost algorithm's classification accuracy on the fusion feature set suggested in this paper can reach 99.87%. In addition, we applied tree-boosting-based LightGBM and CatBoost algorithms to the domain of malware classification for the first time. On our fusion feature set, the corresponding classification accuracy can reach 99.84% and 99.76%, respectively, and the F1-scores can achieve 99.66% and 99.28%, respectively. computer security; machine learning; malware classification; feature fusion +
Footnote †: journal: Applied  
the characteristics in the reports [7; 8; 9; 10; 11]. [PERSON] [12] proposed a machine learning-based malicious program classification system using a dynamic analysis approach. This system efficiently detects PDF malicious files by examining the dynamic execution of a given sample. A novel framework for identifying malicious programs was proposed by [PERSON] et al. [13]. The framework mainly converts the dynamic execution sequence of the original API into a graph of function calls, which preserves majority of the original data and shrinks the input sequence size. The experimental outcomes demonstrate that the framework's F1-score and detection accuracy can reach 97.5% and 97.8%, respectively. [PERSON] et al. [14] analyzed 7107 malicious software applications, including Trojans, worms, and viruses from various families. In a safe sandbox environment, they recorded the Windows operating system's API calls. Then, converted the sequential analysis results into a format that can be used in different classification algorithms. In general, dynamic analysis's main benefit is to try to discover all the actual behaviors of the program, detect malware according to the program's behavior, and not be affected by encryption and obfuscation technology. Thus, it could increase the accuracy of malware classification and identify unknown and variant malware. Nevertheless, because it is difficult to acquire the behavioral features of every execution route and because it uses many resources and much time, this method can only be used to examine the behavior of a single execution path [15]. In addition, recent malware often employs counter-analysis defense mechanisms that can hide malicious behavior in simulated environments [16] and lack of code coverage. Static analysis finds malicious patterns by decomposing code and exploring the control flow of executable files. Static analysis can achieve full code coverage and typically analyze malware bytecode, assembly code, pixel features, file structure, control flow graphs, syntax library calls, etc. For instance, [PERSON] et al. [17] used recursive feature elimination (RFE) and principal component analysis (PCA) algorithms for static feature extraction, thus proposing an intelligent machine-learning algorithm based on KNN and density for detecting ransomware pre-attacks. The suggested technique can effectively increase the accuracy of malware detection, according to experimental data.