Machine Learning Methods for Malware Detection

点击翻译按钮获取中文摘要

Malware detection is an important issue due to its potential of causing severe damage and financial losses. This threat continues to increase, exhibiting an exponential growth. Although solutions using machine learning algorithms exist to address this problem, several critical issues remain unsolved, compromising its application in a real world environment. Currently, critical gaps in malware detection using machine learning include dealing with the rarity and temporal trend of malware cases. Providing robust solutions for malware detection that are able to deal with these gaps is of extreme importance. The long term goal of this research program is to develop special purpose, reliable machine learning algorithms for detecting malware that incorporate relevant domain knowledge. To achieve this goal we defined the following short term goals: (i) develop a framework for feature engineering and selection for malware detection; (ii) develop new special-purpose pre-processing methods for dealing with the typical imbalance of this domain; (iii) develop novel algorithms for malware detection that are capable of taking into account the time-evolving nature of the malware events and their rarity; and (iv) develop solutions that integrate active learning and pre-processing methods for malware detection. The features used by machine learning algorithms must be informative and diversified to capture relevant characteristics of the data. My goal is to define a framework that enables the dynamic extraction and selection of features, enabling its adaptation to different scenarios and time changes occurring in malware attacks. Our research hypothesis is that this framework will help to detect different malware types in a more efficient and robust way. Malware cases are typically rare which creates an additional challenge for machine learning algorithms. We will address this issue by exploring pre-processing methods that provide a high performance gain when tackling the natural imbalance occurring in malware detection problems. We will build upon the most interesting methods to develop novel special-purpose pre-processing strategies specially tailored for the characteristics of this specific domain. The time evolution of malware attacks is a critical issue. Because newly developed malware is more difficult to detect, we will develop methods that take into account the malware's temporal trend in order to be effective in real-world scenarios. The process of manually labeling suspicious malware cases is time consuming. To this end, we will explore special purpose active learning solutions that carefully select representative cases from large collections of data while taking into account the malware rarity. The significance of the research program results from the importance of developing efficient solutions for malware detection that will advance the state-of-the-art on malware detection by exploring machine learning solutions for critical and unsolved issues.