<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.4 20241031//EN"
        "https://jats.nlm.nih.gov/publishing/1.4/JATS-journalpublishing1-4.dtd">
<article  article-type="research-article"        dtd-version="1.4">
            <front>

                <journal-meta>
                                                                <journal-id>saucis</journal-id>
            <journal-title-group>
                                                                                    <journal-title>Sakarya University Journal of Computer and Information Sciences</journal-title>
            </journal-title-group>
                                        <issn pub-type="epub">2636-8129</issn>
                                                                                            <publisher>
                    <publisher-name>Sakarya University</publisher-name>
                </publisher>
                    </journal-meta>
                <article-meta>
                                        <article-id pub-id-type="doi">10.35377/saucis...1049798</article-id>
                                                                <article-categories>
                                            <subj-group  xml:lang="en">
                                                            <subject>Computer Software</subject>
                                                    </subj-group>
                                            <subj-group  xml:lang="tr">
                                                            <subject>Bilgisayar Yazılımı</subject>
                                                    </subj-group>
                                    </article-categories>
                                                                                                                                                        <title-group>
                                                                                                                        <article-title>Malware Detection Method Based on File and Registry Operations Using Machine Learning</article-title>
                                                                                                                                        </title-group>
            
                                                    <contrib-group content-type="authors">
                                                                        <contrib contrib-type="author">
                                                                    <contrib-id contrib-id-type="orcid">
                                        https://orcid.org/0000-0003-0737-1966</contrib-id>
                                                                <name>
                                    <surname>Aslan</surname>
                                    <given-names>Ömer</given-names>
                                </name>
                                                                    <aff>BANDIRMA ONYEDI EYLUL UNIVERSITY, FACULTY OF ENGINEERING AND NATURAL SCIENCES, DEPARTMENT OF SOFTWARE ENGINEERING, SOFTWARE ENGINEERING PR.</aff>
                                                            </contrib>
                                                    <contrib contrib-type="author">
                                                                    <contrib-id contrib-id-type="orcid">
                                        https://orcid.org/0000-0002-2223-3927</contrib-id>
                                                                <name>
                                    <surname>Akin</surname>
                                    <given-names>Erdal</given-names>
                                </name>
                                                                    <aff>BİTLİS EREN ÜNİVERSİTESİ</aff>
                                                            </contrib>
                                                                                </contrib-group>
                        
                                        <pub-date pub-type="pub" iso-8601-date="20220831">
                    <day>08</day>
                    <month>31</month>
                    <year>2022</year>
                </pub-date>
                                        <volume>5</volume>
                                        <issue>2</issue>
                                        <fpage>134</fpage>
                                        <lpage>146</lpage>
                        
                        <history>
                                    <date date-type="received" iso-8601-date="20211228">
                        <day>12</day>
                        <month>28</month>
                        <year>2021</year>
                    </date>
                                                    <date date-type="accepted" iso-8601-date="20220525">
                        <day>05</day>
                        <month>25</month>
                        <year>2022</year>
                    </date>
                            </history>
                                        <permissions>
                    <copyright-statement>Copyright © 2018, Sakarya University Journal of Computer and Information Sciences</copyright-statement>
                    <copyright-year>2018</copyright-year>
                    <copyright-holder>Sakarya University Journal of Computer and Information Sciences</copyright-holder>
                </permissions>
            
                                                                                                <abstract><p>Malware (Malicious Software) is any software which performs malicious activities on computer-based systems without the user&#039;s consent. The number, severity, and complexity of malware have been increasing recently. The detection of malware becomes challenging because new malware variants are using obfuscation techniques to hide themselves from the malware detection systems. In this paper, a new behavioral-based malware detection method is proposed based on file-registry operations. When malware features are generated, only the operations which are performed on specific file and registry locations are considered. The file-registry operations divided into five groups: autostart file locations,  temporary file locations, specific system file locations, autostart registry locations, and DLLs related registry locations. Based on the file-registry operations and where they performed, the malware features are generated. These features are seen in malware samples with high frequencies, while rarely seen in benign samples. The proposed method is tested on malware and benign samples in a virtual environment, and a dataset is created. Well-known machine learning algorithms including C4.5 (J48), RF (Random Forest), SLR (Simple Logistic Regression), AdaBoost (Adaptive Boosting), SMO (Sequential Minimal Optimization), and KNN (K-Nearest Neighbors) are used for classification. In the best case, we obtained 98.8% true positive rate, 0% false positive rate, 100% precision and 99.05% accuracy which is quite high when compared with leading methods in the literature.</p></abstract>
                                                                                    
            
                                                            <kwd-group>
                                                    <kwd>Cybersecurity</kwd>
                                                    <kwd>  malware detection</kwd>
                                                    <kwd>  behavior-based detection</kwd>
                                                    <kwd>  file-registry behaviors</kwd>
                                                    <kwd>  machine learning</kwd>
                                            </kwd-group>
                                                        
                                                                                                                                                    </article-meta>
    </front>
    <back>
                            <ref-list>
                                    <ref id="ref1">
                        <label>1</label>
                        <mixed-citation publication-type="journal">[1] 	Ö. Aslan, R. Samet. &quot;Investigation of possibilities to detect malware using existing tools,&quot; IEEE/ACS 14th International Conference on Computer Systems and Applications (AICCSA) (pp. 1277-1284), October 2017.</mixed-citation>
                    </ref>
                                    <ref id="ref2">
                        <label>2</label>
                        <mixed-citation publication-type="journal">[2]	Ö. Aslan and R.Samet. &quot;A comprehensive review on malware detection approaches,&quot; IEEE Access, 8, 6249-6271, 2020.</mixed-citation>
                    </ref>
                                    <ref id="ref3">
                        <label>3</label>
                        <mixed-citation publication-type="journal">[3]	A. Souri and R. Hosseini. &quot;A state-of-the-art survey of malware detection approaches using data mining techniques,&quot; Human-centric Computing and Information Sciences, 8(1), 1-22, 2018.</mixed-citation>
                    </ref>
                                    <ref id="ref4">
                        <label>4</label>
                        <mixed-citation publication-type="journal">[4] 	Ö. Aslan, R. Samet and Ö.Ö. Tanrıöver. &quot;Using a Subtractive Center Behavioral Model to Detect Malware, &quot; Security and Communication Networks, 2020, 2020.</mixed-citation>
                    </ref>
                                    <ref id="ref5">
                        <label>5</label>
                        <mixed-citation publication-type="journal">[5] 	 J. Nazari. &quot;Defense and Detection Strategies against Internet Worms,&quot; Artech House, 2004.</mixed-citation>
                    </ref>
                                    <ref id="ref6">
                        <label>6</label>
                        <mixed-citation publication-type="journal">[6]   S. Sparks and J. Butler. &quot;Shadow walker: Raising the bar for rootkit detection,&quot; Black Hat Japan, 11(63), 	504-533, 2005.</mixed-citation>
                    </ref>
                                    <ref id="ref7">
                        <label>7</label>
                        <mixed-citation publication-type="journal">[7]	K. Savage, P. Coogan, and H. Lau. &quot;The evolution of ransomware,&quot; Symantec report, August 2015.</mixed-citation>
                    </ref>
                                    <ref id="ref8">
                        <label>8</label>
                        <mixed-citation publication-type="journal">[8]	P. Luckett, J. T. McDonald and J. Dawson. &quot;Neural network analysis of system call timing for rootkit detection,&quot; Cybersecurity Symposium (CYBERSEC) (pp. 1-6), April 2016.</mixed-citation>
                    </ref>
                                    <ref id="ref9">
                        <label>9</label>
                        <mixed-citation publication-type="journal">[9]	Ö. Aslan, Ö. &quot;Performance comparison of static malware analysis tools versus antivirus scanners to detect malware,&quot; In International Multidisciplinary Studies Congress (IMSC), 2017.</mixed-citation>
                    </ref>
                                    <ref id="ref10">
                        <label>10</label>
                        <mixed-citation publication-type="journal">[10]Z. Xu, S. Ray, P. Subramanyan and S. Malik. &quot;Malware detection using machine learning based analysis 	of virtual memory access patterns,&quot; In Design, Automation &amp; Test in Europe Conference &amp; Exhibition 	 (DATE), 2017 (pp. 169-174), March 2017.</mixed-citation>
                    </ref>
                                    <ref id="ref11">
                        <label>11</label>
                        <mixed-citation publication-type="journal">[11] 	N.A. Rosli, W. Yassin, M. A. Faizal and S. R. Selamat. &quot;Clustering Analysis for Malware Behavior 	Detection using Registry Data,&quot; International Journal of Advanced Computer Science and Applications 	 (IJACSA), 10, 12, 2019.</mixed-citation>
                    </ref>
                                    <ref id="ref12">
                        <label>12</label>
                        <mixed-citation publication-type="journal">[12] M. B. Bahador, M. Abadi and A. Tajoddin. &quot;HLMD: a signature-based approach to hardware-level 	behavioral malware detection and classification,&quot; The Journal of Supercomputing, 75(8), 5551-5582, 	2019.</mixed-citation>
                    </ref>
                                    <ref id="ref13">
                        <label>13</label>
                        <mixed-citation publication-type="journal">[13] H. Zhang, W. Zhang, Z. Lv, A. K. Sangaiah, T. Huang and N. Chilamkurti. MALDC: &quot;A depth detection 	method for malware based on behavior chains,&quot; World Wide Web, 23(2), 991-1010, 2020.</mixed-citation>
                    </ref>
                                    <ref id="ref14">
                        <label>14</label>
                        <mixed-citation publication-type="journal">[14] Y. Sun,  A. K. Bashir, U. Tariq and F. Xiao. &quot;Effective malware detection scheme based on classified 	behavior graph in IIoT,&quot; Ad Hoc Networks, 102558, 2021.</mixed-citation>
                    </ref>
                                    <ref id="ref15">
                        <label>15</label>
                        <mixed-citation publication-type="journal">[15]	Malware downloading webstie, &quot;https://www.virusign.com/&quot;, accessible in 2021.</mixed-citation>
                    </ref>
                                    <ref id="ref16">
                        <label>16</label>
                        <mixed-citation publication-type="journal">[16]	Malware downloading webstie, &quot;https://malshare.com/&quot;, accessible in 2021.</mixed-citation>
                    </ref>
                                    <ref id="ref17">
                        <label>17</label>
                        <mixed-citation publication-type="journal">[17]	Malware downloading webstie, &quot;http://www.tekdefense.com/&quot;, accessible in 2021.</mixed-citation>
                    </ref>
                            </ref-list>
                    </back>
    </article>
