Machine learning is among the most popular methods in designing unknown and variant malware detection algorithms. However, most of the existing methods take a single type of features to build binary classi¯ers. In practice, these methods have limited ability in depicting malware characteristics and the binary classi¯cation su®ers from inadequate sampling of benign samples and extremely imbalanced training samples when detecting malware. In this paper, we present a malware detection Framework based on ENsemble One-Class Learning, namely FENOC. It uses hybrid features at di®erent semantic layers to ensure a comprehensive insight of the program to be analyzed. We construct the malware detector by a novel learning algorithm called Cost-sensitive Twin One-class Classi¯er (CosTOC), which uses a pair of one-class clas-si¯ers to describe malware and benign programs respectively. CosTOC is more°exible and robust in comparison to conventional binary classi¯ers when training samples are extremely imbalanced or the benign programs are inadequately sampled. Finally, random subspace method and clustering-based ensemble method are developed to enhance the generalization ability of CosTOC. Experimental results show that FENOC gives a comparative detection rate and a lower false positive rate than many other binary classi¯cation algorithms, especially when the detector are trained with imbalanced data, or evaluated in terms of false positive rate.