Improving malware detection by applying multi-inducer ensemble

Menahem, Eitan; Shabtai, Asaf; Rokach, Lior; Elovici, Yuval

doi:10.1016/j.csda.2008.10.015

Cited by 121 publications

(58 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Similar to the API tri-gram features used in this work, Mehdi et al [12] used N-grams of system calls for malware classification. Using an ensemble of malware classifiers has been proposed by Menahem et al [13]. Very sparse random projections which are used in Section 2 are discussed in [4,5].…”

Section: Related Workmentioning

confidence: 99%

Large-scale malware classification using random projections and neural networks

Dahl

Stokes

Deng

et al. 2013

2013 IEEE International Conference on Acoustics, Speech and Signal Processing

341

164

View full text Add to dashboard Cite

Automatically generated malware is a significant problem for computer users. Analysts are able to manually investigate a small number of unknown files, but the best large-scale defense for detecting malware is automated malware classification. Malware classifiers often use sparse binary features, and the number of potential features can be on the order of tens or hundreds of millions. Feature selection reduces the number of features to a manageable number for training simpler algorithms such as logistic regression, but this number is still too large for more complex algorithms such as neural networks. To overcome this problem, we used random projections to further reduce the dimensionality of the original input space. Using this architecture, we train several very large-scale neural network systems with over 2.6 million labeled samples thereby achieving classification results with a two-class error rate of 0.49% for a single neural network and 0.42% for an ensemble of neural networks.

show abstract

Section: Related Workmentioning

confidence: 99%

Large-scale malware classification using random projections and neural networks

Dahl

Stokes

Deng

et al. 2013

2013 IEEE International Conference on Acoustics, Speech and Signal Processing

341

164

View full text Add to dashboard Cite

show abstract

“…Otherwise there is no point in using multiple estimators. This requirement is similar to the diversity requirement in mixture-of-experts techniques in AI [33] and specifically in malware detection [34]. These methods are very effective, mainly due to the phenomenon that various types of models have different ``inductive biases''.…”

Section: Examining the Effectiveness Of Auto-signmentioning

confidence: 96%

Auto-Sign: an automatic signature generator for high-speed malware filtering devices

Tahan¹,

Glezer²,

Elovici³

et al. 2009

J Comput Virol

Self Cite

View full text Add to dashboard Cite

This research proposes a novel automatic method (termed Auto-Sign) for extracting unique signatures of malware executables to be used by high-speed malware filtering devices based on deep-packet inspection and operating in real-time. Contrary to extant string and tokenbased signature generation methods, we implemented Auto-Sign an automatic signature generation method that can be used on large-size malware by disregarding signature candidates which appear in benign executables. Results from experimental evaluation of the proposed method suggest that picking a collection of executables which closely represents commonly used code, plays a key role in achieving highly specific signatures which yield low false positives.

show abstract

“…The ensemble methodology has been used to improve the predictive performance of single models, in many fields such as: finance [92], bioinformatics [162], medicine [103], cheminformatics [108], manufacturing [130,131,102], geography [26], information security [106,113] Information Retrieval [51,52,142,9,142], Image Retrieval [95,163] and recommender systems [148].…”

Section: Introductionmentioning

confidence: 99%