Distance Metric Learning using Particle Swarm Optimization to Improve Static Malware Detection

Jureček, Martin; Lórencz, Róbert

doi:10.5220/0009180807250732

Cited by 2 publications

(1 citation statement)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This paper can be considered as an extension of them. In [27], we applied the Particle Swarm Optimization algorithm to the problem of finding the appropriate feature weights used in the heterogeneous distance function [28] specifically defined for the PE file format to classify malware and benign files. We showed that the error rate of the KNN classifier could be decreased by 12.77 % using the weighted distance function.…”

Section: B Distance Metric Learning-based Workmentioning

confidence: 99%

Application of Distance Metric Learning to Automated Malware Detection

Jureček

Lórencz

2021

IEEE Access

View full text Add to dashboard Cite

The goal of distance metric learning is to find the most appropriate distance metric parameters to improve similarity-based models such as k-Nearest Neighbors or k-Means. In this paper, we apply distance metric learning to the problem of malware detection. We focus on two tasks: (1) to classify malware and benign files with a minimal error rate, (2) to detect as much malware as possible while maintaining a low false positive rate. We propose a malware detection system using Particle Swarm Optimization that finds the feature weights to optimize the similarity measure. We compare the performance of the approach with three state-of-the-art distance metric learning techniques. We find that metrics trained in this way lead to significant improvements in the k-Nearest Neighbors classification. We conducted and evaluated experiments with more than 150,000 Windows-based malware and benign samples. Features consisted of metadata contained in the headers of executable files in the portable executable file format. Our experimental results show that our malware detection system based on distance metric learning achieves a 1.09 % error rate at 0.74 % false positive rate (FPR) and outperforms all machine learning algorithms considered in the experiment. Considering the second task related to keeping minimal FPR, we achieved a 1.15 % error rate at only 0.13 % FPR.

show abstract

Section: B Distance Metric Learning-based Workmentioning

confidence: 99%

Application of Distance Metric Learning to Automated Malware Detection

Jureček

Lórencz

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

Efficient Malware Analysis Using Metric Embeddings

Rudd¹,

Krisiloff²,

Coull³

et al. 2024

Digital Threats

View full text Add to dashboard Cite

Real-world malware analysis consists of a complex pipeline of classifiers and data analysis – from detection to classification of capabilities to retrieval of unique training samples from user systems. In this paper, we aim to reduce the complexity of these pipelines through the use of low-dimensional metric embeddings of Windows PE files, which can be used in a variety of downstream applications, including malware detection, family classification, and malware attribute tagging. Specifically, we enrich labeling of malicious and benign PE files with computationally-expensive, disassembly-based malicious capabilities information. Using this enhanced labeling, we derive several different types of efficient metric embeddings utilizing an embedding neural network trained via contrastive loss, Spearman rank correlation, and combinations thereof. Our evaluation examines performance on a variety of transfer tasks performed on the EMBER and SOREL datasets, demonstrating that low-dimensional, computationally-efficient metric embeddings maintain performance with little decay. This offers the potential to quickly retrain for a variety of transfer tasks at significantly reduced overhead and complexity. We conclude with an examination of practical considerations for the use of our proposed embedding approach, such as robustness to adversarial evasion and introduction of task-specific auxiliary objectives to improve performance on mission critical tasks.

show abstract

Distance Metric Learning using Particle Swarm Optimization to Improve Static Malware Detection

Cited by 2 publications

References 0 publications

Application of Distance Metric Learning to Automated Malware Detection

Application of Distance Metric Learning to Automated Malware Detection

Efficient Malware Analysis Using Metric Embeddings

Contact Info

Product

Resources

About