Secure folder classification based on file header information

The cyber world has been taking more place in our lives step by step by the technological improvements. It comes up with many security problems, as well. The most important points in these problems are malware-related information leakage, damage and intelligence gathering activities. So the most important study on these area is to detect malicious file and folder regarding to the malware. Since malicious files and folders can be of various types, developing a model based on the detection of these files will be very difficult and costly. One way to eliminate this difficulty is to identify folders that are known to be safe and identify those outside of them as malicious files and folders. In this study, in line with our proposed approach, it was analyzed whether the class of files whose class was known was normal or not, thus the effectiveness of the algorithm in detecting malware was examined. As a method, normal or malicious classes were determined by textual analysis of file names. In our proposed method, malware detection is considered in the supervised learning category and centroid-based classifier algorithm is used. Three different distance/similarity methods were used for the classification process: cosine, Manhattan and euclidean. In our studies, each based on file name information presented with 43 features, the highest classification accuracy of 85% was obtained from the cosine similarity method. In addition, the data set was tested with frequently used machine learning algorithms such as logistic regression, K-nn, Naive Bayes, support vector machine, decision trees and random forest, and the results were given comparatively.