NDLI: Generic feature selection measure for botnet malware detection

Content Provider	IEEE Xplore Digital Library
Author	Berg, P.E. Franke, K. Hai Thanh Nguyen
Copyright Year	2012
Description	Author affiliation: NISlab, Department of Computer Science and Media Technology, Gjövik University College, P.O. box 191, N-2802, Norway (Berg, P.E.; Franke, K.; Hai Thanh Nguyen)
Abstract	Feature selection for botnet malware detection is an important task. In this paper, we study the recently proposed Generic-Feature-Selection (GeFS) measure [18]. Since there is no benchmark dataset of botnet malware, we conduct experiments on the dataset that is generated by using public available tools. We utilize the static and dynamic approaches [24], [29], [12] to extract features from the generated dataset and to produce two separate feature sets. We analyze the statistical properties of these feature sets to provide more insights of their nature and quality. Subsequently we determine appropriate instances of the GeFS measure for feature selection. The GeFS measure was compared experimentally with two different methods regarding the feature selection capabilities in botnet malware detection: the genetic-algorithm-CFS and the best-first-CFS algorithms. We use five different classifiers to test the detection rates and false positive rates. The experiments show that we can remove 99.9% of irrelevant and redundant features from the datasets, while keeping or yielding even better classification performances. Moreover, the GeFS measure outperforms the genetic-algorithm-CFS and the best-first-CFS methods by removing much more redundant features.
Starting Page	711
Ending Page	717
File Size	194510
Page Count	7
File Format	PDF
ISBN	9781467351171
ISSN	21647143
e-ISBN	9781467351195
DOI	10.1109/ISDA.2012.6416624
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-11-27
Publisher Place	India
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Correlation branch and bound mixed 0 – 1 linear programming Data mining machine learning malware analysis Intrusion detection Feature extraction Malware Libraries Mutual information feature selection botnets
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Improving Effectiveness of Intrusion Detection by Correlation Feature Selection

A new ensemble-feature-selection framework for intrusion detection

Towards a Generic Feature-Selection Measure for Intrusion Detection

A feature selection method for malware detection

An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection

Network traffic characteristics for detecting future botnets

Malware detection by text and data mining

Effective Virtual Machine Monitor Intrusion Detection Using Feature Selection on Highly Imbalanced Data

Flow-based identification of botnet traffic by mining multiple log files

Generic feature selection measure for botnet malware detection

Similar Documents

Improving Effectiveness of Intrusion Detection by Correlation Feature Selection

A new ensemble-feature-selection framework for intrusion detection

Towards a Generic Feature-Selection Measure for Intrusion Detection

A feature selection method for malware detection

An Aggregated Mutual Information Based Feature Selection with Machine Learning Methods for Enhancing IoT Botnet Attack Detection

Network traffic characteristics for detecting future botnets

Malware detection by text and data mining

Effective Virtual Machine Monitor Intrusion Detection Using Feature Selection on Highly Imbalanced Data

Flow-based identification of botnet traffic by mining multiple log files

Generic feature selection measure for botnet malware detection