Learning to detect malicious executables in the wild

By J. Kolter, M. Maloof. Knowledge Discovery and Data Mining, 2004

559 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/e72fdc7471e78adec50a6b41792254ce966ce70f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models (2018, methodology): “Machine learning-based static PE malware detectors have been used since at least 2001 [27], and owing largely to the structured file format and backwards-compatibility requirements, many concepts remain surprisingly similar in subsequent works [9, 15, 23, 26, 29].”
Graph-based malware detection using dynamic analysis (2011, methodology): “The n-gram methodology was one of the first malware detection techniques rooted in machine learning and has had great success at detecting obfuscated and polymorphic viruses [11,19,27,28].”
Malware images: visualization and automatic classification (2011, background): “These include both static analysis [13-19] as well as dynamic analysis [20-24].”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, methodology): “Kolter [585] evaluated the datasets by applying a decision tree, TF-IDF, and support vector machine, with a decision tree outperformed.”
Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013, background): “Later, Kolter et al. [36] improved the results obtained by Schulz et al. by using n-grams (i.e., over-3 lapping byte sequences) instead of non-overlapping sequences.”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “…have been reported on using data mining and machine learning techniques to develop intelligent malware detection systems [Schultz et al. 2001; Kolter and Maloof 2004; Karim et al. 2005; Lee and Mody 2006; Ye et al. 2007; Moskovitch et al. 2008a; Kolbitsch et al. 2009; Ye et al. 2010, 2011;…”
Evading Machine Learning Malware Detection (2017, methodology): “In 2004, authors in [12] included byte-level N-grams, and employed techniques from natural language process, including tf-idf weighting of strings.”
Classification of malware using structured control flow (2010, methodology): “Static analysis incorporating ngrams (Kolter and Maloof 2004, Karim et al. 2005), edit distances (Gheorghescu 2005), and control flow (Carrera and Erdélyi 2004, Dullien and Rolles 2005, Briones and Gomez 2008) have been proposed.”
Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN (2017, methodology): “For example, Schultz et al. proposed to use DLLs, APIs and strings as features for classiﬁcation [Schultz et al. , 2001], while Kolter et al. used byte level N-Gram as features [Kolter and Maloof, 2004; Kolter and Maloof, 2006].”
Learning to Detect and Classify Malicious Executables in the Wild (2006, methodology): “We did not conduct this experiment from the outset (Kolter and Maloof, 2004) because it was impossible to determine the date of discovery of all of the malicious executables in our collection.”
Neural Nets Can Learn Function Type Signatures From Binaries (2017, background): “Such tasks include malware classification [42, 5, 30, 20, 36, 15] and function identification [37, 7, 43].”
Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey (2009, methodology): “Kolter and Maloof (2004) evaluated data sets using several inducers: IBK (KNN), a similarity based classifier called the TFIDF classifier, Naı̈ve Bayes, Support Vector Machine (SVM) and Decision Tree (J48).”
Malware Classification with Deep Convolutional Neural Networks (2018, methodology): “Our baseline method GIST+SVM achieves the accuracy of 93.23%; however, our M-CNN yields the best performance with accuracy of 98.52%.”
Reviewer Integration and Performance Measurement for Malware Detection (2015, background): “st prior work was evaluated on limited number of malicious and benign instances from a single repository source (e.g., VX Heaven) and/or with low or unquantiﬁed diversity in terms of malware families [15,16,25,30]. The largest dataset of binary executables can be found in Markel et al. [18] and cons”
Malware Analysis and Classification: A Survey (2014, result): “[27].”
Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning (2018, methodology): “The resulting feature vector represents a fairly holistic view of the malware sample, and encapsulates elements used by machine learning malware models in industry and academia [8, 16, 24, 26, 28].”