# MLMD--A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm
## 1 Introduction  
Today's digital devices have become tightly interconnected with people's lives--almost everyone uses them to store and access information. However, due to the value of the affected information, these devices are increasingly targeted by various types of attacks, with attackers often using malware programs. These are programs that can perform some kind of malicious activity in the attacked system [1]. According to the statistics published by Malwarebytes [2], the number of threats is increasing every year, and so is their severity. As a result of a malware attack, one may lose not only easily replaceable data, but also sensitive data and even money. The media reports on the dangers of malware more and more frequently, showing its effects on both companies and individuals. Even corporations are becoming aware of the seriousness of the situation and are thus devoting significant parts of their budgets to IT security [3].  
Providers of security solutions rush to provide a fix; however, to develop new malware detection capabilities, they have to react to the constant evolution of existing threats and the day-to-day appearance of new malware. Traditional detection methods are often no longer sufficient to counter the more advanced techniques used by malware to bypass detection by security software. Another disadvantage of using traditional malware detection methods is that they can only detect malware that has been previously analysed and whose symptoms are already known. System security software developers also address the need for more sophisticated malware detection techniques using machine learning models that learn from specific input data, as they have been successfully applied to a range of other contemporary problems [4]. An example of the successfully used innovative approaches in the formof deep neural network algorithms can be seen in the products of the company Deep Insitinct [5].  
Analysis of the literature has led us to believe that the potential of using machine learning based on the results of a combination of static and dynamic malware analysis has not yet been explored and compared with the results obtained from state-of-the-art practical solutions, such as those included in VirusTotal.  
The main contributions of this work are the following:  
* Analysis of the success of particular machine learning algorithms, such as extreme gradient boosting (XGBoost), extreme random trees (ET), and others, in their application in the field of malware detection;
* Exploration of the potential of combining static and dynamic analysis of malware samples through Dependency Walker for static analysis and Cuckoo Sandbox for dynamic analysis in machine learning applications for malware detection;
* Automation of malware analysis and classification using a newly designed solution in the form of a software tool;
* Comparison of the proposed software tool with the published theoretical works, as well as with the solutions used in practice, included in the VirusTotal service.  
Section 2 discusses the basics of malware detection and provides an overview of the current state of the art. Section 3 describes the origin of malicious and benign samples, how they were processed into datasets using Dependency Walker and Cuckoo Sandbox, how the models themselves were trained, and how the best hyperparameters were found. Then, an assessment of the models and their best use in the proposed _Machine Learning Malware Detector_ (MLMD) program follows. This chapter also includes the basic design of the program, along with some screenshots of the graphical user interface. In Section 4, we compare our results with the other resources and also compare the success of our program with that of the VirusTotal tool. Section 5 concludes and summarizes the paper.