Adaptive Rule-Based Malware Detection Employing Learning Classifier Systems: A Proof of Concept

Abstract

Efficient and accurate malware detection is increasingly becoming a necessity for society to operate. Existing malware detection systems have excellent performance in identifying known malware for which signatures are available, but poor performance in anomaly detection for zero day exploits for which signatures have not yet been made available or targeted attacks against a specific entity. The primary goal of this paper is to provide evidence for the potential of learning classifier systems to improve the accuracy of malware detection. A proof of concept is presented for adaptive rule-based malware detection employing learning classifier systems, which combines a rule-based expert system with evolutionary algorithm based reinforcement learning, thus creating a self-training adaptive malware detection system which dynamically evolves detection rules. Experimental results are presented which demonstrate the system's ability to learn effective rules from repeated presentations of a tagged training set and show the degree of generalization achieved on an independent test set.

Meeting Name

35th Annual IEEE International Computer Software and Applications Conference Workshops, COMPSACW 2011 (2011: Jul. 18-21, Munich, Germany)

Department(s)

Computer Science

Sponsor(s)

Missouri University of Science and Technology. Natural Computation Laboratory

Keywords and Phrases

Learning Classifier Systems; Malware Detection

International Standard Book Number (ISBN)

978-0769544595

International Standard Serial Number (ISSN)

0730-3157

Document Type

Article - Conference proceedings

Document Version

Citation

File Type

text

Language(s)

English

Rights

© 2011 Institute of Electrical and Electronics Engineers (IEEE), All rights reserved.

Publication Date

01 Jan 2011

Link to Full Text

Share

 
COinS