Large-Scale Malicious Software Classification With Fuzzified Features and Boosted Fuzzy Random Forest

Abstract

Classification of malicious software, especially in a very large dataset, is a challenging task for machine intelligence. Malware can have highly diversified features, each of which has highly heterogeneous distributions. These factors increase the difficulties for traditional data analytic approaches to deal with them. Although deep learning-based methods have reported good classification performance, the deep models usually lack interpretability and are fragile under adversarial attacks. To solve these problems, fuzzy systems have become a competitive candidate in malware analysis. In this paper, a new fuzzy-based approach is proposed for malware classification. We focused on portable executable files in the Windows platform and analyzed the distributions of static features and content-oriented features. Fuzzification was used to reduce the ubiquitous impact of noise and outliers in a very large dataset. Finally, a novel boosted classifier consisted of fuzzy decision trees and support vector machine is proposed to perform the malware classification. By using fuzzy decision trees, the inner structure of the classifier can be readily interpreted as discriminative rules, while the novel boosting strategy provides state-of-the-art classification performance. Extensive experimental results showed that our method significantly outperformed several state-of-the-art classifiers.

Розробка Методу Ідентифікації Стану Комп'ютерної Системи На Основі Нечітких Дерев Рішень

“…Особливо це актуально при ідентифікації стану КС, оскільки тут існує чимало факторів, які важко передбачити. Цей недолік можна зменшити, застосовуючи нейронні мережі, теорію нечітких множин та відповідне програмне забезпечення [16].…”

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

“…Similar methods that utilize Learning-Based Generative Model for PDF files [16], Concept Drift Detection with Sequential Deep Learning (CDS SDL) for batch malwares [17], Fuzzified Features with Boosted Fuzzy Random Forest (FBRF) [18], and RNN for visualization of malwares [19] are discussed by researchers. These models aim at improving inter-class feature variance via rigorous analysis of extracted features in order to identify malwarespecific models that can be deployed for on-field use cases.…”