NDLI: Cloud-based malware detection for evolving data streams

Please wait, while we are loading the content...

Cloud-based malware detection for evolving data streams

Content Provider	ACM Digital Library
Author	Hamlen, Kevin W. Masud, Mohammad M. Han, Jiawei Thuraisingham, Bhavani Gao, Jing Al-khateeb, Tahseen M. Khan, Latifur
Copyright Year	2011
Abstract	Data stream classification for intrusion detection poses at least three major challenges. First, these data streams are typically infinite-length, making traditional multipass learning algorithms inapplicable. Second, they exhibit significant concept-drift as attackers react and adapt to defenses. Third, for data streams that do not have any fixed feature set, such as text streams, an additional feature extraction and selection task must be performed. If the number of candidate features is too large, then traditional feature extraction techniques fail. In order to address the first two challenges, this article proposes a multipartition, multichunk ensemble classifier in which a collection of $\textit{v}$ classifiers is trained from $\textit{r}$ consecutive data chunks using $\textit{v}-fold$ partitioning of the data, yielding an ensemble of such classifiers. This multipartition, multichunk ensemble technique significantly reduces classification error compared to existing single-partition, single-chunk ensemble approaches, wherein a single data chunk is used to train each classifier. To address the third challenge, a feature extraction and selection technique is proposed for data streams that do not have any fixed feature set. The technique's scalability is demonstrated through an implementation for the Hadoop MapReduce cloud computing architecture. Both theoretical and empirical evidence demonstrate its effectiveness over other state-of-the-art stream classification techniques on synthetic data, real botnet traffic, and malicious executables.
Starting Page	1
Ending Page	27
Page Count	27
File Format	PDF
ISSN	2158656X
DOI	10.1145/2019618.2019622
Volume Number	2
Issue Number	3
Journal	ACM Transactions on Management Information Systems (TMIS)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2008-10-18
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Data mining Data streams Malicious executable Malware detection N-gram analysis
Content Type	Text
Resource Type	Article
Subject	Management Information Systems Computer Science

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

A scalable multi-level feature extraction technique to detect malicious executables

A Survey on Data Mining Methods for Malware Detection

Density-based clustering of data streams at multiple resolutions

ELF-Miner: using structural knowledge and data mining methods to detect new (Linux) malicious executables

Clustering over Multiple Evolving Streams by Events and Correlations

HDM-Analyser: a hybrid analysis approach based on data mining techniques for malware detection

Adaptive Clustering for Multiple Evolving Streams

Behavior-Based Malware Analysis and Detection

On change diagnosis in evolving data streams

Cloud-based malware detection for evolving data streams

Similar Documents

A scalable multi-level feature extraction technique to detect malicious executables

A Survey on Data Mining Methods for Malware Detection

Density-based clustering of data streams at multiple resolutions

ELF-Miner: using structural knowledge and data mining methods to detect new (Linux) malicious executables

Clustering over Multiple Evolving Streams by Events and Correlations

HDM-Analyser: a hybrid analysis approach based on data mining techniques for malware detection

Adaptive Clustering for Multiple Evolving Streams

Behavior-Based Malware Analysis and Detection

On change diagnosis in evolving data streams

Cloud-based malware detection for evolving data streams