Cyber threat intelligence includes analysis of applications and their metadata for potential threats. Static malware detection of Windows executable files can be done through the analysis of Portable Executable (PE) application file headers. Benchmark datasets are available with PE file attributes; however, there is scope for updating the data and also to research novel attribute reduction and performance improvement algorithms. The existing benchmark dataset contains non-PE header attributes, and few ignored attributes. In this work, a critical analysis was conducted to develop a new dataset called SOMLAP (Swarm Optimization and Machine Learning Applied to PE Malware Detection) with a value addition to the existing benchmark dataset. The SOMLAP data contains 51,409 samples that include both benign and malware files, with a total of 108 pure PE file header attributes. Further research was carried out to improve the performance of the Malware Detection System (MDS) by feature minimization using swarm optimization tools, viz., Ant Colony Optimization (ACO), Cuckoo Search Optimization (CSO), and Grey Wolf Optimization (GWO) wrapped with machine learning tools. The dataset was evaluated, and an accuracy of 99.37% with an optimized set of 12 features (ACO) proves the efficiency of the dataset, its attributes, and the algorithms used.

Malware Security Intelligence constitutes the analysis of applications and their associated metadata for possible security threats. Application Programming Interfaces (API) calls contain valuable information that can help with malware identification. The malware analysis with reduced feature space helps for the efficient identification of malware. The goal of this research is to find the most informative features of API calls to improve the android malware detection accuracy. Three swarm optimization methods, viz., Ant Lion Optimization (ALO), Cuckoo Search Optimization (CSO), and Firefly Optimization (FO) are applied to API calls using auto-encoders for identification of most influential features. The nature-inspired wrapper-based algorithms are evaluated using well-known Machine Learning (ML) classifiers such as Linear Regression (LR), Decision Tree (DT), Random Forest (RF), K–Nearest Neighbor (KNN) & Support Vector Machine (SVM). A hybrid Artificial Neuronal Classifier (ANC) is proposed for improving the classification of android malware. The experimental results yielded an accuracy of 98.87% with just seven features out of hundred API call features, i.e., a massive 93% of data optimization.

Application Programming Interface (API) call feature analysis is the prominent method for dynamic android malware detection. Standard benchmark android malware API dataset includes features with high dimensionality. Not all features of the data are relevant, filtering unwanted features improves efficiency. This paper proposes fuzzy and meta-heuristic optimization hybrid to eliminate insignificant features and improve the performance. In the first phase fuzzy benchmarking is used to select the top best features, and in the second phase meta-heuristic optimization algorithms viz., Moth Flame Optimization (MFO), Multi-Verse Optimization (MVO) & Whale Optimization (WO) are run with Machine Learning (ML) wrappers to select the best from the rest. Five ML methods viz., Decision Tree (DT), Random Forest (RF),K-Nearest Neighbors (KNN), Naïve Bayes (NB) & Nearest Centroid (NC) are compared as wrappers. Several experiments are conducted and among them, the best post reduction accuracy of 98.34% is recorded with 95% elimination of features. The proposed novel method outperformed among the existing works on the same dataset.