Run-time malware detection based on positive selection

Abstract

This paper presents a supervised methodology that detects malware based on positive selection. Malware detection is a challenging problem due to the rapid growth of the number of malware and increasing complexity. Run-time monitoring of program execution behavior is widely used to discriminate between benign and malicious executables due to its effectiveness and robustness. This paper proposes a novel classification algorithm based on the idea of positive selection, which is one of the important algorithms in Artificial Immune Systems (AIS), inspired by positive selection of T-cells. The proposed algorithm is applied to learn and classify program behavior based on I/O Request Packets (IRP). In our experiments, the proposed algorithm outperforms ANSC, Naïve Bayes, Bayesian Networks, Support Vector Machine, and C4.5 Decision Tree. This algorithm can also be used in general purpose classification problems not just two-class but multi-class problems.

Challenges of Malware Detection in the IoT and a Review of Artificial Immune System Approaches

“…The negative selection method uses the supervised learning classification algorithm, which was inspired by the "process of self-tolerance of B-cells, and CLONALG, which is inspired by clonal selection theory and consists of mutation and selection processes" [37]. The method works in two phases: the detector generation phase, and the matching and detection phase.…”

“…The Positive Selection Classification algorithm (PSCA) is a general classification algorithm that classifies unknown data using classifiers that can recognize self-class (system files) data. The authors in [37] applied PCSA to malware detection with the following steps: a learning stage, where the method learns how to classify data into two different classes (self and non-self), and stimulation and mutate stages. Finally, the radius is a threshold used for classification, as opposed to the usual classification approach where the minimal distance between several centers is used.…”

“…The authors in [37] proposed using the positive selection algorithm (PCSA) for malware detection. They define the PCSA as a general classification algorithm used for unknown data classification.…”

“…They also define two states after classification: overlap, where the unknown data is recognized by more than two kinds of classifiers; and hole, where the unknown data cannot be recognized by any classifier. To evaluate the proposed algorithm, the researchers in [37] compared their solution to another algorithm in [52]. In total, 3721 Windows malicious executables and 3458 benign Windows executables were collected for the experiment.…”

Artificial Immune System Based Frameworks and Its Application in Cyber Immune System: A Comprehensive Review

“…Detectors from the two sorts, the positive and negative markers, which can perceive a greater amount of elements in the related dataset, are acknowledged as developed while remaining is believed to be premature. Fuyong and Deyu [29] proposed an algorithm named PSCA for recognizing malware utilizing the idea of positive selection in AIS. This algorithm works by grouping packets dependent on I/O Request bundles by different programs.…”