Linux Malware Detection Using eXtended–Symmetric Uncertainty

Abstract

Abstract. We propose a novel two step dimensionality reduction approach based on correlation using machine learning techniques for identifying unseen malicious Executable Linkable Files (ELF). System calls used as features are dynamically extracted in a sandbox environment. The extended version of symmetric uncertainty (X-SU) proposed by us, ranks feature by determining Feature-Class correlation using entropy, information gain and further eliminate the redundant features by estimating Feature-Feature correlation using weighted probabilistic information gain. Three learning algorithms (J48, Adaboost and Random Forest) are employed to generate prediction models, from the system call traces. Optimal feature vector constructed using minimum feature length (27 no.) resulted in over all classification accuracy of 99.40% with very less false alarm to identify unknown malicious specimens.

Classification of malicious process using high‐level activity based dynamic analysis

“…The process marks its impact in this space and generates hypergrams that act as its profile while classification. Giving a new way, Ashmita et al have proposed another approach based on system call features and have given a two‐step dimensionality reduction based on the correlation. Authors have used symmetric uncertainty (X‐SU) which ranks the Feature‐Class as the correlation based on entropy and information gain.…”