An Ensemble Cost-Sensitive One-Class Learning Framework for Malware Detection

摘要: Machine learning is among the most popular methods in designing unknown and variant malware detection algorithms. However, of existing take a single type features to build binary classifiers. In practice, these have limited ability depicting characteristics classification suffers from inadequate sampling benign samples extremely imbalanced training when detecting malware. this paper, we present Framework based on ENsemble One-Class Learning, namely FENOC. It uses hybrid at different semantic layers ensure comprehensive insight program be analyzed. We construct detector by novel algorithm called Cost-sensitive Twin One-class Classifier (CosTOC), which pair one-class classifiers describe programs respectively. CosTOC more flexible robust comparison conventional are or inadequately sampled. Finally, random subspace method clustering-based ensemble developed enhance generalization CosTOC. Experimental results show that FENOC gives comparative rate lower false positive than many other algorithms, especially trained with data, evaluated terms rate.