FindMal: A file-to-file social network based malware detection framework

摘要: Abstract The rapid development of malicious software programs has posed severe threats to Computer and Internet security. Therefore, it motivates anti-malware vendors researchers develop novel methods which are capable protecting users against new threats. Existing malware detectors mostly treat the file samples separately using supervised learning algorithms. However, ignoring relationship among limits capability detectors. In this paper, based on file-to-file social network, we present a detection framework, FindMal( F ile-to-File Soc i al N etwork base d Mal ware Detection Framework), including graph-based features extraction, Label Propagation algorithm, active strategy. Nearest neighbors first chosen as adjacent nodes for each node construct kNN relation graph. Three graph proposed sample representative labeling. Then, propagates label information from labeled unlabeled files, is applied learn probability that one unknown classified or benign. A batch mode method employed reduce labeling cost improve performance Propagation. Comprehensive experiments real large scale dataset obtained an company performed. results demonstrate our FindMal outperforms other existing models in classifying samples.