Application of Distance Metric Learning to Automated Malware Detection
Distance metric learning aims to find the most appropriate distance metric parameters to improve similarity-based models such as <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Nearest Neighbors or <inline-formula> <tex-math not...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9469874/ |
| _version_ | 1818739232733134848 |
|---|---|
| author | Martin Jurecek Robert Lorencz |
| author_facet | Martin Jurecek Robert Lorencz |
| author_sort | Martin Jurecek |
| collection | DOAJ |
| description | Distance metric learning aims to find the most appropriate distance metric parameters to improve similarity-based models such as <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Nearest Neighbors or <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Means. In this paper, we apply distance metric learning to the problem of malware detection. We focus on two tasks: (1) to classify malware and benign files with a minimal error rate, (2) to detect as much malware as possible while maintaining a low false positive rate. We propose a malware detection system using Particle Swarm Optimization that finds the feature weights to optimize the similarity measure. We compare the performance of the approach with three state-of-the-art distance metric learning techniques. We find that metrics trained in this way lead to significant improvements in the <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Nearest Neighbors classification. We conducted and evaluated experiments with more than 150,000 Windows-based malware and benign samples. Features consisted of metadata contained in the headers of executable files in the portable executable file format. Our experimental results show that our malware detection system based on distance metric learning achieves a 1.09 % error rate at 0.74 % false positive rate (FPR) and outperforms all machine learning algorithms considered in the experiment. Considering the second task related to keeping minimal FPR, we achieved a 1.15 % error rate at only 0.13 % FPR. |
| first_indexed | 2024-12-18T01:21:34Z |
| format | Article |
| id | doaj.art-5383831d2faa4d65866b10004152d104 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-18T01:21:34Z |
| publishDate | 2021-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-5383831d2faa4d65866b10004152d1042022-12-21T21:25:49ZengIEEEIEEE Access2169-35362021-01-019961519616510.1109/ACCESS.2021.30940649469874Application of Distance Metric Learning to Automated Malware DetectionMartin Jurecek0https://orcid.org/0000-0002-6546-8953Robert Lorencz1Department of Information Security, Faculty of Information Technology, Czech Technical University in Prague, Prague, Czech RepublicDepartment of Information Security, Faculty of Information Technology, Czech Technical University in Prague, Prague, Czech RepublicDistance metric learning aims to find the most appropriate distance metric parameters to improve similarity-based models such as <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Nearest Neighbors or <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Means. In this paper, we apply distance metric learning to the problem of malware detection. We focus on two tasks: (1) to classify malware and benign files with a minimal error rate, (2) to detect as much malware as possible while maintaining a low false positive rate. We propose a malware detection system using Particle Swarm Optimization that finds the feature weights to optimize the similarity measure. We compare the performance of the approach with three state-of-the-art distance metric learning techniques. We find that metrics trained in this way lead to significant improvements in the <inline-formula> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula>-Nearest Neighbors classification. We conducted and evaluated experiments with more than 150,000 Windows-based malware and benign samples. Features consisted of metadata contained in the headers of executable files in the portable executable file format. Our experimental results show that our malware detection system based on distance metric learning achieves a 1.09 % error rate at 0.74 % false positive rate (FPR) and outperforms all machine learning algorithms considered in the experiment. Considering the second task related to keeping minimal FPR, we achieved a 1.15 % error rate at only 0.13 % FPR.https://ieeexplore.ieee.org/document/9469874/Distance metric learningmalware detectionparticle swarm optimization<italic xmlns:ali="http://www.niso.org/schemas/ali/1.0/" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">k</italic>-nearest neighbors |
| spellingShingle | Martin Jurecek Robert Lorencz Application of Distance Metric Learning to Automated Malware Detection IEEE Access Distance metric learning malware detection particle swarm optimization <italic xmlns:ali="http://www.niso.org/schemas/ali/1.0/" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">k</italic>-nearest neighbors |
| title | Application of Distance Metric Learning to Automated Malware Detection |
| title_full | Application of Distance Metric Learning to Automated Malware Detection |
| title_fullStr | Application of Distance Metric Learning to Automated Malware Detection |
| title_full_unstemmed | Application of Distance Metric Learning to Automated Malware Detection |
| title_short | Application of Distance Metric Learning to Automated Malware Detection |
| title_sort | application of distance metric learning to automated malware detection |
| topic | Distance metric learning malware detection particle swarm optimization <italic xmlns:ali="http://www.niso.org/schemas/ali/1.0/" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">k</italic>-nearest neighbors |
| url | https://ieeexplore.ieee.org/document/9469874/ |
| work_keys_str_mv | AT martinjurecek applicationofdistancemetriclearningtoautomatedmalwaredetection AT robertlorencz applicationofdistancemetriclearningtoautomatedmalwaredetection |