A code refactoring and machine learning based approach for the detection of PHP malware

Abstract

The proliferation of malware has necessitated advanced techniques for detection and prevention. This research investigates the impact of refactoring PHP code on the effectiveness of machine learning algorithms in detecting malware. By manipulating the PHP Abstract Syntax Tree (AST), various refactoring patterns were applied to generate a cleaner code base. The study compares the performance of multiple machine learning models, including Bernoulli Naive Bayes, KNeighbors, Decision Tree, Logistic Regression, SVM, Random Forest, AdaCost, and Gradient Boosting Decision Trees, before and after code refactoring. Results indicate significant improvements in recall, precision, accuracy, and F1 score post-refactoring, demonstrating the potential of AST-based code manipulation in enhancing malware detection.