electronics Article Ensemble-Based Classification Using Neural Networks and Machine Learning Models for Windows PE Malware Detection Robertas Damaševiˇcius 1,* , Algimantas Venˇckauskas 2 , Jevgenijus Toldinas 2 and Šarunas¯ Grigaliunas¯ 2 1 Department of Software Engineering, Kaunas University of Technology, 44249 Kaunas, Lithuania 2 Department of Computer Science, Kaunas University of Technology, 44249 Kaunas, Lithuania;
[email protected] (A.V.);
[email protected] (J.T.);
[email protected] (Š.G.) * Correspondence:
[email protected] Abstract: The security of information is among the greatest challenges facing organizations and institutions. Cybercrime has risen in frequency and magnitude in recent years, with new ways to steal, change and destroy information or disable information systems appearing every day. Among the types of penetration into the information systems where confidential information is processed is malware. An attacker injects malware into a computer system, after which he has full or partial access to critical information in the information system. This paper proposes an ensemble classification- based methodology for malware detection. The first-stage classification is performed by a stacked ensemble of dense (fully connected) and convolutional neural networks (CNN), while the final stage classification is performed by a meta-learner. For a meta-learner, we explore and compare 14 classifiers. For a baseline comparison, 13 machine learning methods are used: K-Nearest Neighbors, Linear Support Vector Machine (SVM), Radial basis function (RBF) SVM, Random Forest, AdaBoost, Decision Tree, ExtraTrees, Linear Discriminant Analysis, Logistic, Neural Net, Passive Classifier, Ridge Classifier and Stochastic Gradient Descent classifier. We present the results of experiments Citation: Damaševiˇcius,R.; performed on the Classification of Malware with PE headers (ClaMP) dataset.