# MLMD--A Malware-Detecting Antivirus Tool Based on the XGBoost Machine Learning Algorithm
## 2 Theoretical Background
### Reference Works  
Malware detection using machine learning techniques was first addressed by [PERSON] et al. in their work [14], using static analysis techniques, focusing on features including extracted strings, header information from executable files (the called and imported functions), and a contiguous sequence of n bytes (_n-grams_). The authors of the aforementioned paper used three machine learning algorithms (RIPPER, naive Bayes (NB), and multi-NB),complemented with a traditional malware detection method (signature-based detection) for comparison purposes. The overall detection accuracy in their experiments ranged from 83.62% to 97.11% when using machine learning algorithms, which was a significant increase compared to the traditional, signature-based detection, which had an overall accuracy of 49.28%. The use of static analysis techniques was also discussed by [PERSON] et al. [15]. In their work, they used 197 features extracted from the headers of executable files, namely the number of API calls and the number of dynamically linked libraries used. To select the most appropriate features that could best distinguish between malicious and benign samples, the authors used filtering and wrapper methods. The algorithms used and compared in this work were decision-tree-based algorithms, namely the J48 and random forest (RF) algorithms. By performing several experiments, the authors achieved an overall detection accuracy ranging from 94.6% to 99.1%. The header information of the executables was also used by [PERSON] et al. [16], who used an integrated feature set with a total of 68 features. The authors used and compared a total of six algorithms in their work, namely the NB, RF, decision tree (DT), logistic regression (LR), linear discriminant analysis (LDA), and k-nearest neighbors (KNN) algorithms. The overall detection accuracies achieved ranged from 56.04% to 98.78%. The least successful algorithm in the comparison was the NB algorithm, while the most successful algorithm with the best detection accuracy was the RF algorithm. The features of decompiled machine code--opcode sequences of various lengths--were used by [PERSON] [17], who also used and compared six algorithms, namely the NB, RF, KNN, multilayer perceptron (MLP), support vector machine (SVM), and J48 algorithms. Again, the most successful algorithm with the best detection accuracy was the RF algorithm, as it achieved a detection accuracy of 95.58% for three-byte sequences (3-grams). By extracting five-byte sequences (5-grams) and API call information from the headers of the executable files, [PERSON] et al. [18] used and compared the success rates of multiple algorithms, notably the NB, J48, RF, SVM, and MLP. They performed several experiments according to the type of features used. The best detection accuracy (97.7%) was obtained using artificial neural network (ANN) with a feed-forward perceptron and combining both types of features. According to this work, the least successful algorithm was the NB algorithm, with a detection accuracy of 87.5%. The authors of the aforementioned works extracted the features by using only static analysis techniques. The issue with this malware detection approach was described by [PERSON] et al. [19], citing the use of obfuscation techniques to hide malicious code as the main reason. Thus, they recommend also using dynamic analysis, which is less vulnerable to this problem. In addition to the features obtained by extracting strings from executables using static analysis techniques, [PERSON] and [PERSON] [20] also performed dynamic analysis in an isolated virtual environment to obtain information including registry changes and API function call counts. In their work, they compared the RF and SVM algorithms and their success rates in different types of analysis, through several experiments. They obtained the best result (98.7%) by applying the SVM algorithm to features obtained by combining static and dynamic analysis.