Comparison of feature selection and classification algorithms in identifying malicious executables

Authors:
D. Michael Cai;Maya Gokhale;James Theiler
Affiliations:
Space Data Systems Group, Los Alamos National Laboratory, Los Alamos, NM 87545, USA;Advanced Computing Laboratory, Los Alamos National Laboratory, Los Alamos, NM 87545, USA;Space and Remote Sensing Sciences Group, Los Alamos National laboratory, Los Alamos, NM 87545, USA
Venue:
Computational Statistics & Data Analysis
Year:
2007

Citing 17
Cited 4

A cryptographic checksum for integrity protection

Computers and Security
An evaluation of phrasal and clustered representations on a text categorization task

SIGIR '92 Proceedings of the 15th annual international ACM SIGIR conference on Research and development in information retrieval
Support-Vector Networks

Machine Learning
Wrappers for feature subset selection

Artificial Intelligence - Special issue on relevance
Inductive learning algorithms and representations for text categorization

Proceedings of the seventh international conference on Information and knowledge management
Fast training of support vector machines using sequential minimal optimization

Advances in kernel methods
A re-examination of text categorization methods

Proceedings of the 22nd annual international ACM SIGIR conference on Research and development in information retrieval
A Tutorial on Support Vector Machines for Pattern Recognition

Data Mining and Knowledge Discovery
A Study of Approaches to Hypertext Categorization

Journal of Intelligent Information Systems
Text Categorization with Suport Vector Machines: Learning with Many Relevant Features

ECML '98 Proceedings of the 10th European Conference on Machine Learning
A Comparative Study on Feature Selection in Text Categorization

ICML '97 Proceedings of the Fourteenth International Conference on Machine Learning
MEF: Malicious Email Filter - A UNIX Mail Filter That Detects Malicious Windows Executables

Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference
Data Mining Methods for Detection of New Malicious Executables

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
An extensive empirical study of feature selection metrics for text classification

The Journal of Machine Learning Research
Information Theory, Inference & Learning Algorithms

Information Theory, Inference & Learning Algorithms
Learning to detect malicious executables in the wild

Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining
Improvements to Platt's SMO Algorithm for SVM Classifier Design

Neural Computation

Detection of unknown computer worms based on behavioral classification of the host

Computational Statistics & Data Analysis
Improving malware detection by applying multi-inducer ensemble

Computational Statistics & Data Analysis
A study of detecting computer viruses in real-infected files in the n-gram representation with machine learning methods

IEA/AIE'10 Proceedings of the 23rd international conference on Industrial engineering and other applications of applied intelligent systems - Volume Part I
A layered classification for malicious function identification and malware detection

Concurrency and Computation: Practice & Experience

Quantified Score

Hi-index	0.03

Visualization

Abstract

Malicious executables, often spread as email attachments, impose serious security threats to computer systems and associated networks. We investigated the use of byte sequence frequencies as a way to automatically distinguish malicious from benign executables without actually executing them. In a series of experiments, we compared classification accuracies over seven feature selection methods, four classification algorithms, and variable byte sequence lengths. We found that single-byte patterns provided surprisingly reliable features to separate malicious executables from benign. Between classifiers and feature selection methods, the overall performance of the models depended more on the choice of classifier than the method of feature selection. Support vector machine (SVM) classifiers were found to be superior in terms of prediction accuracy, training time, and aversion to overfitting.