Classification of Spyware from Network Packets with Decision Trees Using Recursive Feature Elimination (RFE)

Abstract

Spyware allows cyber attackers to access systems without permission and perform actions such as monitoring, changing, misusing, and deleting important data. This study used Decision Trees and the RFE feature selector to classify spyware, a type of malware, by network packets. An experimental environment was prepared using the laboratory infrastructure of Firat University Faculty of Technology, Forensic Informatics Department to collect various network packets using different spyware. The collected network packets underwent feature extraction with the Tshark program. The most weighted features were selected from the extracted features using Recursive Feature Elimination (RFE), Relief, and Neighbor Component Analysis (NCA). Decision Trees (DT) are used to classify selected features. The results obtained with the RFE feature selector are very similar to state-of-the-art results.