Improving malware detection using multi‐view ensemble learning

Abstract

The huge influx of new malware is created every day, and those malware have not been previously seen in the wild. Current anti‐virus software uses byte signature to identify known malware and has little hope of identifying new malware. Researchers have proposed several malware detection methods based on byte n‐grams, opcode n‐grams, and format information, and those methods partially capture the distinguishable information between benign and malicious programs. In this study, we design two schemes to incorporate the aforementioned three single‐view features and fully exploit complementary information of those features to discover the true nature of a program. Two datasets are used to evaluate new malware detection performance and generalization performance of the proposed schemes. Experimental results indicate that the proposed schemes increase the detection rate of new malware, improve the generalization performance of learning model, and reduce the false alarm rate to 0%. Because malware is hard to disguise itself in every feature view, the proposed schemes are more robust and not easy to be deceived. Copyright © 2016 John Wiley & Sons, Ltd.

An Efficient Malware Detection System using Hybrid Feature Selection Methods

“…Much research on malware analysis and detection have been done based on static, dynamic and machine learning approaches. The malware detection techniques in the literature focusses on feature extraction from malware samples and the extracted features are directly given to the classification models [3] [13]. This section presents a survey of various methods employed for identifying malware.…”

Enhancing Malware Detection with Static Analysis using Machine Learning

“…Table 1 shows combination of different features for data set and the accuracy and false positive rate. We uses 4-gram as n-gram because result obtain from 4-gram is better [8] .…”

“…Static analysis is the safe analysis and the dynamic analysis require more resources, it requires a virtual environment for analysis and malware after detecting the virtual environment can change its behavior [2,4]. In recent years researcher have applied machine learning for malware analysis for detecting the unknown malwares whose signature is not known beforehand [8]. It uses dataset for the same.…”

“…In order to train the model we require to first get the features of the samples. Features can either be obtained statically or dynamically [4,8]. Different features used are printable string information, n-gram, op-code sequence, API calls, PE header, format feature, etc.…”

“…In [4] the author has done survey on static features such as byte n-gram, opcode-ngram, PE32, API calls and concluded that the result obtained from navie bayes and bayes network is poor. In [8] the author combines different features such as byte n-gram, opcode n-gram and format features to obtain the nature of the file. In [4] the author analysis the malware on the basis of behavior and the features used is based on API call.…”