Incremental Learning for Malware Classification in Small Datasets

Abstract

Information security is an important research area. As a very special yet important case, malware classification plays an important role in information security. In the real world, the malware datasets are open-ended and dynamic, and new malware samples belonging to old classes and new classes are increasing continuously. This requires the malware classification method to enable incremental learning, which can efficiently learn the new knowledge. However, existing works mainly focus on feature engineering with machine learning as a tool. To solve the problem, we present an incremental malware classification framework, named “IMC,” which consists of opcode sequence extraction, selection, and incremental learning method. We develop an incremental learning method based on multiclass support vector machine (SVM) as the core component of IMC, named “IMCSVM,” which can incrementally improve its classification ability by learning new malware samples. In IMC, IMCSVM adds the new classification planes (if new samples belong to a new class) and updates all old classification planes for new malware samples. As a result, IMC can improve the classification quality of known malware classes by minimizing the prediction error and transfer the old model with known knowledge to classify unknown malware classes. We apply the incremental learning method into malware classification, and the experimental results demonstrate the advantages and effectiveness of IMC.

Internet of Things Applications, Security Challenges, Attacks, Intrusion Detection, and Future Visions: A Systematic Review

“…Incremental Learning is used by Zhuang et al [120] for proposing a Malware Detection algorithm to preserve support vectors obtained from old data of SVM. Intrusion Detection is done using Incremental Multiclass SVM by Li et al [121]. Although using Incremental Learning is required for real-time detection, here small dataset is used, so the sample size used for classification is significantly less, and SVM performance is not suitable for such scenarios.…”

Incremental learning framework for real‐world fraud detection environment

“…Most of the malware datasets are dynamic in real-life, which necessitates the malware classification to be incremental to learn new knowledge over time. The study 16 presented an incremental malware classification framework based on a multiclass SVM, titled IMCSVM. The latter constrains the new model by retaining it close to the old model for the new knowledge of old classes and constraining the new classification plane by retaining it close to the new planes' linear combination for the new knowledge of new classes.…”

Toward Identifying APT Malware through API System Calls

“…ey also analyzed its performance and obtained an accuracy of 96.3%. Li et al [15] proposed an incremental malware classification (IMC) framework and an incremental learning method based on multiclass support vector machines (SVM), which improved the classification ability of IMCSVM incrementally by learning new malware samples. Baldangombo et al [20] presented a static malware detection system to extract valuable features of Windows portable executable (PE) files using the static analysis method.…”

“…To identify families of APT malware samples, the current work analyzes typical malicious malware behaviors of different APT families to distinguish them [2,14]. However, the number of publicly available malware samples from each APT family is small, making it difficult to train a robust classification model through such a small number of samples [15].…”