Shellcode Classification with Machine Learning Based on Binary Classification

Abstract

The Internet can link one person to another using their respective devices. The internet itself has both positive and negative impacts. One example of the internet's negative impact is malware that can disrupt or even kill a device or its users; that is why cyber security is required. Many methods can be used to prevent or detect malware. One of the efforts is to use machine learning techniques. The training and testing dataset for the experiments is derived from the UNSW_NB15 dataset. K-Nearest Neighbour (KNN), Decision Tree, and Naïve Bayes classifiers are implemented to classify whether a record in the testing data is Shellcode or non-Shellcode attack. The KNN, Decision Tree, and Naïve Bayes classifiers achieve accuracy levels of 96.82%, 97.08%, and 63.43%, respectively. The results of this research are expected to provide insight into the use of machine learning in detecting or classifying malware or other types of cyber attacks.