Multiclass Malware Detection in Operational Technology Systems Using Machine Learning on PE Header Specifications

Abstract

Malware, short for malicious software, presents a substantial cybersecurity threat within operational technology (OT) systems. It delineates the diverse array of malware threats, encompassing, backdoors, trojans, viruses, worms, and trojan-droppers, highlighting their potential to disrupt industrial operations and compromise sensitive data. In this paper, realm of multi-class classification of malware within OT systems is focused underscoring the pressing need for tailored malware detection techniques in such environments. To effectively counter these threats, Signature-based Detection (SD) method alongside machine learning algorithms are employed on labeled datasets. Multiclass classification of malware is focused in which the intricate process of data pre-processing is elucidated which involves extracting, cleaning, and transforming raw PE file data to facilitate machine learning analysis. Moreover, it elucidates the integration of H2O AutoML for optimizing models and evaluates the performance of various machine learning algorithms using key metrics. The proposed approach provides valuable insights into the sophisticated methodologies employed for multi-class malware classification in OT systems, thereby enhancing cybersecurity measures in critical infrastructure sectors. Results shows that the proposed approach has the 96.8% accuracy better than the state of the art techniques which focus only on two classes such as malicious and benign.