Hybrids of support vector machine wrapper and filter based framework for malware detection

Abstract

h i g h l i g h t s• A signature-free malware detection approach has been proposed. • A hybrid wrapper-Filter based malware feature selection has been proposed. • Proposed hybrid approach can take advantages from both filter and wrapper. • Models have also been validated by statistical model selection criteria such as Chi Square and Akaike information criterion (AIC). a b s t r a c tMalware replicates itself and produces offspring with the same characteristics but different signatures by using code obfuscation techniques. Current generation Anti-Virus (AV) engines employ a signaturetemplate type detection approach where malware can easily evade existing signatures in the database. This reduces the capability of current AV engines in detecting malware. In this paper we propose a hybrid framework for malware detection by using the hybrids of Support Vector Machines Wrapper, MaximumRelevance-Minimum-Redundancy Filter heuristics where Application Program Interface (API) call statistics are used as a malware features. The novelty of our hybrid framework is that it injects the filter's ranking score in the wrapper selection process and combines the properties of both wrapper and filters and API call statistics which can detect malware based on the nature of infectious actions instead of signature. To the best of our knowledge, this kind of hybrid approach has not been explored yet in the literature in the context of feature selection and malware detection. Knowledge about the intrinsic characteristics of malicious activities is determined by the API call statistics which is injected as a filter score into the wrapper's backward elimination process in order to find the most significant APIs. While using the most significant APIs in the wrapper classification on both obfuscated and benign types malware datasets, the results show that the proposed hybrid framework clearly surpasses the existing models including the independent filters and wrappers using only a very compact set of significant APIs. The performances of the proposed and existing models have further been compared using binary logistic regression. Various goodness of fit comparison criteria such as Chi Square, Akaike's Information Criterion (AIC) and Receiver Operating Characteristic Curve ROC are deployed to identify the best performing models. Experimental outcomes based on the above criteria also show that the proposed hybrid framework outperforms other existing models of signature types including independent wrapper and filter approaches to identify malware.

Intelligent OS X malware threat detection with code inspection

“…Mohaisen et al [13] proposed an unsupervised behavioral based (dynamic) Windows malware classification technique by monitoring file system and memory interactions and achieved more than 98% precision. Huda et al [14] proposed a hybrid framework for malware detection based on programs interactions with Windows Application Program Interface (API) using Support Vector Machines (SVM) wrappers and statistical measures and obtained over 96% detection accuracy.…”

Multilayer hybrid strategy for phishing email zero‐day filtering

“…SMO is a WEKA implementation of the sequential minimal optimization algorithm. It is a fast version of support vector machine, which form an important class . SMO can be invoked in WEKA with four kernels.…”

“…Figure 3 presents the results obtained in filtering phishing emails by these kernels of BN for Dataset A of Table I as training set and Datasets B and C of Table I as validate sets. SMO is a WEKA implementation of the sequential minimal optimization algorithm. It is a fast version of support vector machine, which form an important class [52,53]. SMO can be invoked in WEKA with four kernels.…”

Malware detection using bilayer behavior abstraction and improved one-class support vector machines

“…Lakhotia et al [17] developed n-perms, a variant of n-gram, to formalize Op-codes into feature representation. It is noteworthy that API sequences can also be extracted via disassembling [18]. However, only a few malware analysis methods use API sequences obtained by static disassembling, because it is hard to decide parameters of API or track branches and jumps of the execution paths by static analysis.…”

“…Accordingly, an ensemble perceptron algorithm is adopted in [29] with kernel trick and optimized training time to detect unknown and variant malware with low false positive rate. Actually, recent research has already tried and evaluated the most popular supervised learning algorithms in behaviorbased malware detection, such as support vector machine (SVM) [18,29,30], decision trees [12], Naïve Bayes [28] and SMO [23].…”