A malware detection model based on a negative selection algorithm with penalty factor

Abstract

A malware detection model based on a negative selection algorithm with penalty factor (NSAPF) is proposed in this paper. This model extracts a malware instruction library (MIL), containing instructions that tend to appear in malware, through deep instruction analysis with respect to instruction frequency and file frequency. From the MIL, the proposed model creates a malware candidate signature library (MCSL) and a benign program malware-like signature library (BPMSL) by splitting programs orderly into various short bit strings. Depending on whether a signature matches "self", the NSAPF further divides the MCSL into two malware detection signature libraries (MDSL1 and MDSL2), and uses these as a two-dimensional reference for detecting suspicious programs. The model classifies suspicious programs as malware and benign programs by matching values of the suspicious programs with MDSL1 and MDSL2. Introduction of a penalty factor C in the negative selection algorithm enables this model to overcome the drawback of traditional negative selection algorithms in defining the harmfulness of "self" and "nonself", and focus on the harmfulness of the code, thus greatly improving the effectiveness of the model and also enabling the model to satisfy the different requirements of users in terms of true positive and false positive rates. Experimental results confirm that the proposed model achieves a better true positive rate on completely unknown malware and a better generalization ability while keeping a low false positive rate. The model can balance and adjust the true positive and false positive rates by adjusting the penalty factor C to achieve better performance. CitationZhang P T, Wang W, Tan Y. A malware detection model based on a negative selection algorithm with penalty factor.

Immune cooperation mechanism based learning framework

“…A malware detection model based on a negative selection algorithm with penalty factor (NSAPF) was proposed [7]. The NSAPF punishes the features of nonself which match the features of self instead of deleting them directly.…”

Recent advances on trusted computing in China

“…Zhang et al [32] developed a malware detection model based on a negative selection algorithm with a penalty factor, which overcomes the drawback of the traditional negative selection algorithms in defining harmfulness of "self" and "nonself" by introducing the penalty factor. By adjusting the penalty factor, the model can achieve a tradeoff between true positive and false positive rates to satisfy the different requirements of users.…”

Botnet Propagation via Public Websited Detection Algorithm / Botnet Plitimo Viešuose Interneto Tinkluose Aptikimo Algoritmas

“…In cases when a popular compromised site is used for malware propagation, many unaware site visitors can be attacked and become a part of a botnet. Binary checking and methods used in various solutions to malware detection (Li et al 2007;Juknius et al 2009;Zhang et al 2010) often fail to identify simple redirection schemes and JavaScript traps. While checking the source of the obviously attacked sites, we found that the website had no malware itself but acted as a redirector to source or performed browser exploitation.…”