# Malware Detection Using Memory Analysis Data in Big Data Environment
## 4 Material and Methods
### Dataset  
The CIC-MalMem-2022 dataset [43] used in this study was made available by the Canadian Institute for Cybersecurity in 2022. The dataset is designed to test obfuscated malware detection methods using memory dumps. CIC-MalMem-2022 is a balanced dataset with a total of 58,596 records. Of the records that it contains, 29,298 are benign and 29,298 are malicious. The malicious memory dump was created by executing software samples collected from VirusTotal on a VM with 2 GB memory. Next, normal behavior was collected by running applications on the machine to generate a bona fide memory dump [44]. The dataset contains three different types of malwares: Spyware, Ransomware, and Trojan. As seen in Table 2, there are samples of 15 different malware families in the dataset.  
\begin{table}
\begin{tabular}{c c c} \hline
**ID** & **Modul.Feature\_Name** & **Description** \\ \hline
1 & Category & Category \\
2 & pslist.npproc & Total number of processes \\
3 & pslist.nppid & Total number of parent processes \\
4 & pslist.avg\_threads & Average number of threads for the processes \\
5 & pslist.nprocs64 bit & Total number of 64 bit processes \\
6 & pslist.avg\_handlers & Average number of handlers \\
7 & dllist.ndlls & Total number of loaded libraries for every process \\
8 & dllist.avg\_dlls\_per\_proc & Average number of loaded libraries per process \\
9 & handles.nhandles\_handles\_per\_proc & Total number of opened handles \\
10 & handles.avg\_handles\_per\_proc & Average number of handles per process \\
11 & handles.nport & Total number of port handles \\
12 & handles.nfile & Total number of file handles \\
13 & handles.nevent & Total number of event handles \\
14 & handles.ndesktop & Total number of desktop handles \\
15 & handles.nkey & Total number of key handles \\
16 & handles.ntherad & Total number of thread handles \\
17 & handles.ndirectory & Total number of directory handles \\
18 & handles.nsemaphore & Total number of spamborge handles \\
19 & handles.ntimer & Total number of timer handles \\
20 & handles.nsection & Total number of section handles \\
21 & handles.nmutant & Total number of mutant handles \\
22 & ldrmodules.not\_in\_load & Total number of modules missing from the load list \\
23 & ldrmodules.not\_in\_init & Total number of modules missing from the init list \\
24 & ldrmodules.not\_in\_mem & Total number of modules missing from the memory list \\
25 & ldrmodules.not\_in\_load\_avg & The average amount of modules missing from the load list \\
26 & ldrmodules.not\_in\_init\_avg & The average amount of modules missing from the init list \\
27 & ldrmodules.not\_in\_mem\_avg & The average amount of modules missing from the memory \\
28 & malfind.ninjections & Total number of hidden code injections \\
29 & malfind.commitCharge & Total number of Commit Charges \\
30 & malfind.protection & Total number of protection \\ \hline \end{tabular}
\end{table}
Table 2: Detailed explanation of the attributes of the CIC-MalMem-2022 dataset.  
In addition, the dataset contains 57 attributes that contain traces of these malware families in memory. These attributes are seen in Table 3.