Learning to Detect and Classify Malicious Executables in the Wild

By J. Kolter, M. Maloof, Richard P. Lippmann. 2006

664 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Practical Evasion of a Learning-Based Classifier: A Case Study (2014, background): “, [37], [38], [39], [40], which uses n-grams, or short byte sequences, as basic features.”
Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection (2016, methodology): “This contrasts with some solutions proposed in where no feature selection algorithm is proposed [20], [28].”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, methodology): “Static features like PE headers [31], code patterns [7], instruction sequences [16] or binary sequences [15] are extracted and used to train various learning algorithms [19] for malware categorization and detection.”
Malware classification with recurrent networks (2015, methodology): “∗The first author performed the work while at Microsoft Research wide variety of machine learning classifiers such as logistic regression [2], neural networks [3, 4], and decision trees [5] for malware classification.”
Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey (2009, background): “IG ðS;AÞ ¼ EðSÞ X v˛VðAÞ jSvj jSj $EðSvÞ (5) EðSÞ ¼ X c˛C jScjjSj $log2 jScj jSj (6) Kolter and Maloof (2006) and Zhang et al. (2007) used Information-Gain measure.”
Scalable, Behavior-Based Malware Clustering (2009, background): “Other researchers have proposed to represent a malware program as a hex-dump of its code segment, building a classification system on top of this [30].”
Evaluation of machine learning classifiers for mobile malware detection (2014, neutral): “…into sequence matching comparisons (Gribskov and Robinson 1996), comparing the best average conﬁguration in experiments (Shabtai et al. 2012), visualizing and analyzing the behaviour of diagnostic systems (Lamiaa Ibrahim et al. 2013) and evaluating classiﬁer accuracy (Kolter and Maloof 2006).”
Review: machine learning techniques applied to cybersecurity (2019, methodology): “Associated to the spread of Internet usage, malicious code and software have appeared to compromise computer systems, attacking and destroying the information they contain [3].”
Language models for detection of unknown attacks in network traffic (2007, methodology): “Our method Zeta [ 44 ] is an anomaly score based on the concept of k-nearest neighbors; it extends the outlier detection methods proposed in [45,46].”
Automated Classification and Analysis of Internet Malware (2007, neutral): “Recently, Kolter and Maloof [13] studied applying machine learning to classify malicious executables using n-grams of byte codes.”
Polonium: Tera-Scale Graph Mining and Inference for Malware Detection (2011, neutral): “Rather, our goal is to come up with a new, high-level method that can automatically identify more malware instances similar to the ones that have already been flagged by our company as harmful and that the user should remove immediately, or would be removed automatically for them by our security…”
A Machine Learning Approach to Android Malware Detection (2012, methodology): “Other approaches [17], [28], [32] focus on using machine learning and data mining approaches for malware detection.”
Survey on the Usage of Machine Learning Techniques for Malware Analysis (2017, background): “However, there are surveyed works that rely on benign datasets whose size is bigger than the size of malicious ones [12, 15, 40, 42, 69, 71, 73, 76].”
Large-scale malware classification using random projections and neural networks (2013, background): “Most earlier research has been done on relatively small malware sample collections [2, 3] limiting the accuracy of these systems.”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, methodology): “In our implementation, we experiment with using n-grams as proposed in [9, 25, 38] because the feature space is extremely large, and dynamic behavior analysis from Bayer et al.”
Learning and Classification of Malware Behavior (2008, methodology): “These techniques are especially e«ective against byte-level content analysis [18] [20] and static malware analysis methods [8] [10] [12].”
Automatic analysis of malware behavior using machine learning (2011, neutral): “Machine learning for classiﬁcation of malware binaries has been ﬁrst studied by [56] and [29].”