Dynamic behavior analysis through novel windows event logs with machine learning

With the acceleration of technological developments, cyber attacks and malware threats are becoming increasingly complex and dangerous. This situation demonstrates the necessity of developing innovative approaches and effective solutions in the field of information security. This thesis aims to enhance the effectiveness of dynamic methods in malware analysis by focusing particularly on the detailed examination of Windows operating system event log data. The primary objective of the study is to extract meaningful features from the operating system log data generated during the runtime of malicious and benign software in isolated virtual environments and to develop an innovative approach for malware detection using machine learning techniques. To this end, executable files, determined to be either malicious or benign through both manual and online verification processes, have been meticulously collected. The data obtained from experimental applications conducted in controlled virtual machine environments were primarily classified as numerical, contextual, time-based, and statistical features. In determining which of these features could be utilized, some were further refined through feature engineering techniques, thereby creating critical indicators that enhance model performance. The relevant features were processed using various classification algorithms such as Gradient Boosting, Logistic Regression, and Support Vector Machines; the performance of the resulting models was rigorously evaluated using the K-Fold cross-validation method. The applied data normalization and feature engineering techniques not only increased the overall accuracy of the models but also clarified the distinction between malicious and benign software. This comprehensive analysis has demonstrated that dynamic analysis-based approaches provide higher accuracy rates and lower error margins compared to traditional static methods. Furthermore, this study aims to make a significant contribution to the field of dynamic analysis, an area that has been relatively underrepresented in the literature. Comprehensive experiments conducted on different datasets have revealed that the developed methodology can offer a proactive approach against cyber attacks. Dynamic behavior analysis yields effective results over extended time intervals in detecting both old and new malware, thereby playing a critical role in the development of cybersecurity strategies. In conclusion, this thesis illustrates the applicability and effectiveness of dynamic analysis methods in malware detection and prevention, opening new horizons in the field of cybersecurity.