Leveraging Uncertainty for Improved Static Malware Detection Under Extreme False Positive Constraints
The detection of malware is a critical task for the protection of computing environments. This task often requires extremely low false positive rates (FPR) of 0.01% or even lower, for which modern machine learning has no readily available tools. We introduce the first broad investigation of the use of uncertainty for malware detection across multiple datasets, models, and feature types. We show how ensembling and Bayesian treatments of machine learning methods for static malware detection allow for improved identification of model errors, uncovering of new malware families, and predictive performance under extreme false positive constraints. In particular, we improve the true positive rate (TPR) at an actual realized FPR of 1e-5 from an expected 0.69 for previous methods to 0.80 on the best performing model class on the Sophos industry scale dataset. We additionally demonstrate how previous works have used an evaluation protocol that can lead to misleading results.
Code (0)
등록된 구현이 없습니다.
Tasks
BIG-bench Machine LearningMalware DetectionSimilar Papers 제목 키워드 기반
Light up that Droid! On the Effectiveness of Static Analysis Features against App Obfuscation for Android Malware Detection
Malware authors have seen obfuscation as the mean to bypass malware detectors based on static analysis features. For Android, several studies have confirmed that many anti-malware products are easily evaded with simple p…
Android Malware DetectionMalware DetectionA novel DL approach to PE malware detection: exploring Glove vectorization, MCC_RCNN and feature fusion
In recent years, malware becomes more threatening. Concerning the increasing malware variants, there comes Machine Learning (ML)-based and Deep Learning (DL)-based approaches for heuristic detection. Nevertheless, the pr…
Malware DetectionA Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection
In this research, we compare malware detection techniques based on static, dynamic, and hybrid analysis. Specifically, we train Hidden Markov Models (HMMs ) on both static and dynamic feature sets and compare the resulti…
Malware DetectionAssessing the Impact of Packing on Machine Learning-Based Malware Detection and Classification Systems
The proliferation of malware, particularly through the use of packing, presents a significant challenge to static analysis and signature-based malware detection techniques. The application of packing to the original exec…
Malware DetectionOMD: Orthogonal Malware Detection Using Audio, Image, and Static Features
With the growing number of malware and cyber attacks, there is a need for "orthogonal" cyber defense approaches, which are complementary to existing methods by detecting unique malware samples that are not predicted by o…
Malware Detection