Improving Multivariate Microaggregation through Hamiltonian Paths and Optimal Univariate Microaggregation

Maya-López, Armando; Casino, Fran; Solanas, Agustí

doi:10.3390/sym13060916

Cited by 6 publications

(2 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that the groups created may obey the heuristics of the algorithm, different data distribution, and some elements that would be in a cluster may appear in another according to an algorithm's optimisation metric, e.g. the overall information loss or the intercluster similarity [41,18]. However, despite such group variations, the distance between the elements will persist since data are the same, and the parameters of clustering algorithms can be tuned to create different grouping strategies according to specific needs.…”

Section: Dataset D300mentioning

confidence: 99%

On the Effectiveness of Binary Emulation in Malware Classification

Vouvoutsis¹,

Casino²,

Patsakis³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Malware authors are continuously evolving their code base to include counter-analysis methods that can significantly hinder their detection and blocking. While the execution of malware in a sandboxed environment may provide a lot of insightful feedback about what the malware actually does in a machine, anti-virtualisation and hooking evasion methods may allow malware to bypass such detection methods. The main objective of this work is to complement sandbox execution with the use of binary emulation frameworks. The core idea is to exploit the fact that binary emulation frameworks may quickly test samples quicker than a sandbox environment as they do not need to open a whole new virtual machine to execute the binary. While with this approach, we lose the granularity of the data that can be collected through a sandbox, due to scalability issues, one may need to simply determine whether a file is malicious or to which malware family it belongs. To this end, we record the API calls that are performed and use them to explore the efficacy of using them as features for binary and multiclass classification. Our extensive experiments with real-world malware illustrate that this approach is very accurate, achieving state-of-the art outcomes with a statistically robust set of classification experiments while simultaneously having a relatively low computational overhead compared to traditional sandbox approaches. In fact, we compare the binary analysis results with a commercial sandbox, and our classification outperforms it at the expense of the fine-grained results that a sandbox provides.

show abstract

Section: Dataset D300mentioning

confidence: 99%

On the Effectiveness of Binary Emulation in Malware Classification

Vouvoutsis¹,

Casino²,

Patsakis³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Heuristics like minimum distance to average (MDAV) [6,8] and variable minimum distance to average (VMDAV) [19] sequentially build groups of fixed (MDAV) or variable (VMDAV) size based on considering the distances of the points to their centroid. Other approaches first order the multivariate points and apply the polynomial time algorithm of [11] to the ordered set of points, such as in [7], which used several fast ordering algorithms based on paths in the graph that is associated with the set of points, whereas [14] used (slower) Hamiltonian paths (which involve the solution of a traveling salesman problem). The heuristic of [16] also sequentially builds a set of clusters attempting to locally minimize IL.…”

Section: Introductionmentioning

confidence: 99%

An Optimization-Based Decomposition Heuristic for the Microaggregation Problem

Castro

Gentile

Spagnolo-Arrizabalaga

2022

Privacy in Statistical Databases

View full text Add to dashboard Cite

Given a set of points, the microaggregation problem aims to find a clustering with a minimum sum of squared errors (SSE), where the cardinality of each cluster is greater than or equal to k. Points in the cluster are replaced by the cluster centroid, thus satisfying k-anonymity. Microaggregation is considered one of the most effective techniques for numerical microdata protection. Traditionally, non-optimal solutions to the microaggregation problem are obtained by heuristic approaches. Recently, the authors of this paper presented a mixed integer linear optimization (MILO) approach based on column generation for computing tight solutions and lower bounds to the microaggregation problem. However, MILO can be computationally expensive for large datasets. In this work we present a new heuristic that combines three blocks: (1) a decomposition of the dataset into subsets, (2) the MILO column generation algorithm applied to each dataset in order to obtain a valid microaggregation, and (3) a local search improvement algorithm to get the final clustering. Preliminary computational results show that this approach was able to provide (and even improve upon) some of the best solutions (i.e., of smallest SSE) reported in the literature for the Tarragona and Census datasets, and k ∈ {3, 5, 10}.

show abstract