\section{Literature review}

Malware is now an international word, which gained prominence following the
creation and development of the internet. There are many definitions of
malware. Malware is often defined as a short form of malicious software 
containing malicious programs such as computer viruses and worms. With the
increasing sophistication of malware attacks and their potential for causing
major damage and disruption, there is an ongoing need for the development of
more advanced malware detectors\cite{Malware-tech}.

\subsection{Malware Detection: Approaches}

Malware detectors employ a variety of malware detection techniques depending on
the type of malware being targetted. In general, malware detection techniques
can be classified into two groups: the first group is heuristic-based (or
anomaly-based) detection that defines normal behaviour in order to determine
the maliciousness of the software. The second group is signature-based
detection that compares the code content to the code signature of known malware in
order to decide the maliciousness of a program under inspection. However,
current detection techniques that are based on known malware are unable to
detect a malcode unless it has been executed. Hence, not all malwares can
be detected by these two techniques alone. Therefore, it is crucial to consider how
we can extend the available detection tools by designing and developing a
detection system capable of detecting other unknown
malwares\cite{Malware-tech}.
 

In recent years, machine learning methods were introduced to the malware
detection systems to extend the effectiveness of heuristic-based methods. The
classification algorithm is one of the standard methods in machine learning
that could solve the problem of detecting unknown malwares\cite{Machin-learn}.
The idea of classification algorithm is based on pattern matching. The
classifier contains a set of learnt patterns and decides the maliciousness of
an unknown program by comparing to these learnt patterns. The learnt pattern set is as
a result of applying learning methods on a training set that contain instances
of both malicious and benign files. A recent study on integrating machine
learning methods with heuristic-base methods produced positive results in
detecting new malware\cite{Machin-learn}. The file representation and feature
selection methods are other machine learning techniques that greatly improve
the result of malware detection systems. The latter method is concerned with
patterns used for demonstrating executable files while the former seeks to
decrease the dimensionality of patterns that appear in the
file\cite{Machin-learn}.

Polymorphic viruses are a complex type of malware that many widely used malware
detection software will fail to detect because such malware detection software
tends to employ Heuristic-based and signature-based algorithms. Furthermore, the
drawbacks to using signature-based methods are that they are expensive and also
slow.  The recently designed system called Intelligent Malware Detection System
(IMDS) is capable of recognising both polymorphic and previously unseen
malicious executable (new) malware. The evaluation and experimental results of the IMDS illustrated its high performance compared with some anti-virus software such as McAfee virus scan. IMDS uses data mining based classification method and the architecture of the IMDS system includes three main modules; the parser,the rule generator and the malware detection part\cite{IMDS}.

One of the most commonly used formats for reading documents is PDF. Therefore,
it is likely that an attackers use PDF files for malicious purposes. Also, it
is important to note the structure of PDF documents, which is made up of a
sequence of flexible dictionary objects. This flexibility makes PDF files more
attractive for an attacker because they can host a variety of applications such
as java script and embedded files. Attackers mostly apply obfuscation
techniques to bypass intelligent detection systems. With the aid of machine
learning techniques, a new PDF detector has been designed to recognise infected
PDF documents\cite{maiorca2012pattern}.  The PDF detector contains three main
steps; a data retrieval module, a feature extractor module and the classifier.
The system adapted K-mean clustering method to collect the set of keywords for
the feature extractor module. The classifier was tested using different
classification algorithms such as Naïve Bayes and SVM, with the most accurate
and efficient algorithm being selected for the final
design\cite{maiorca2012pattern}.
 
The signature-based method can fail to detect the obfuscation code because the
obfuscation only has a minor effect on execution behaviour. Gao et al proposed
the semantic based malware detection algorithm to handle obfuscation in
infected documents. According to this algorithm the semantic of the program is
compared to the semantic of the malware. As a result, this proposed method
reduces the need for frequently updating the malware database; hence making it
remarkably robust\cite{Amom}. 


Malware is continuing to grow and become more complex. An effective malware
detector must be capable of detecting unknown malware as well as hidden
malcode. However, malware writers analyse the techniques used in commercial
malware scanners and attempt to produce new malware that can bypass the
techniques adopted by such virus scanners. Therefore, an increase in unknown
malware is, at present, innevitable\cite{vinod2009survey}.


Another study performed on malware detection methods was called BINSPECT, which
provided a lightweight approach to identifying malicious web pages. This
approach employed supervised learning technique for its detection and
considered malware distributing techniques such as; phishing,
derived-by-download and injection\cite{eshete2012binspect}.

BINSPECT used an unknown webpage as an input and classified the web page as
either malicious or benign. Its classification relied on the features extracted
from a given web page and the web page features were defined in three
categories; features of URL, source code of webpage and social reputation
features.  For the URL features, the structure of URL (for example, number of
dots ‘.’) or the length of the URL string was analyzed. The results showed the
most malicious URL had an abnormal length. For the web page source code, an
emulated browser was used to capture the obfuscated JavaScript. Some of the
features considered in the web page sources code included the number of; lines,
links and suspicious functions. The extracted features were then used to
collect the data for the training set and learning set. The data was then
classified by applying machine-learning methods such as Logistic Regression,
SVM (Support Vector Machine) and Decision Tree\cite{eshete2012binspect}.  The
paper concludes its proposed method is very effective in detecting a malicious
webpage with an accuracy rate exceeding 97\% and that by adding the new
features to the system improved its performance significantly. However
BINSPECT lacked the ability to analyse obfuscated
JavaScript\cite{eshete2012binspect}. 
