NDLI: Tracking concept drift in malware families

Please wait, while we are loading the content...

Machine learning meets social networking security: detecting and analyzing malicious social networks for fun and profit

Improving malware classification: bridging the static/dynamic gap

Learning stateful models for network honeypots

Robust detection of comment spam using entropy rate

Tracking concept drift in malware families

Early detection of malicious behavior in JavaScript code

Nonparametric semi-supervised learning for network intrusion detection: combining performance improvements with realistic in-situ training

Understanding the time-series behavioral characteristics of evolutionally advanced email spammers

Autonomous learning for detection of JavaScript attacks: vision or reality?

An information theoretic framework for web inference detection

On the effectiveness of using state-of-the-art machine learning techniques to launch cryptographic distinguishing attacks

Tracking concept drift in malware families

Content Provider	ACM Digital Library
Author	Lakhotia, Arun Walenstein, Andrew Singh, Anshuman
Abstract	The previous efforts in the use of machine learning for malware detection have assumed that malware population is stationary i.e. probability distribution of the observed characteristics (features) of malware populations don't change over time. In this paper, we investigate this assumption for malware families as populations. Malware, by design, constantly evolves so as to defeat detection. Evolution in malware may lead to a nonstationary malware population. The problem of nonstationary populations has been called concept drift in machine learning. Tracking concept drift is critical to the successful application of ML based methods for malware detection. If the evolution causes the malware population to drift rapidly then frequent retraining of classifiers may be required to prevent degradation in performance. On the other hand, if the drift is found to be negligible, then ML based methods are robust for such populations for long periods of time. We propose two measures for tracking concept drift in malware families when feature sets are very large-relative temporal similarity and metafeatures. We illustrate the use of the proposed measures with a study on 3500+ samples from three families of x86 malware, spanning over 5 years. The results of the study show negligible drift in mnemonic 2-grams extracted from unpacked versions of the samples. The measures can likewise be applied to track drift in any number of malware families. Tracking drift in this manner also provides a novel method for feature type selection, i.e., use the feature type that drifts the least.
Starting Page	81
Ending Page	92
Page Count	12
File Format	PDF
ISBN	9781450316644
DOI	10.1145/2381896.2381910
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2012-10-19
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Concept drift Temporal similarity Metafeatures Malware
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in