Adaptive Rule-Based Malware Detection Employing Learning Classifier Systems: A Proof of Concept
Efficient and accurate malware detection is increasingly becoming a necessity for society to operate. Existing malware detection systems have excellent performance in identifying known malware for which signatures are available, but poor performance in anomaly detection for zero day exploits for which signatures have not yet been made available or targeted attacks against a specific entity. The primary goal of this paper is to provide evidence for the potential of learning classifier systems to improve the accuracy of malware detection. A proof of concept is presented for adaptive rule-based malware detection employing learning classifier systems, which combines a rule-based expert system with evolutionary algorithm based reinforcement learning, thus creating a self-training adaptive malware detection system which dynamically evolves detection rules. Experimental results are presented which demonstrate the system's ability to learn effective rules from repeated presentations of a tagged training set and show the degree of generalization achieved on an independent test set.
J. J. Blount et al., "Adaptive Rule-Based Malware Detection Employing Learning Classifier Systems: A Proof of Concept," Proceedings of the 35th Annual IEEE International Computer Software and Applications Conference, pp. 110 - 115, Institute of Electrical and Electronics Engineers (IEEE), Jan 2011.
The definitive version is available at https://doi.org/10.1109/COMPSACW.2011.28
35th Annual IEEE International Computer Software and Applications Conference Workshops, COMPSACW 2011 (2011: Jul. 18-21, Munich, Germany)
Missouri University of Science and Technology. Natural Computation Laboratory
Keywords and Phrases
Learning Classifier Systems; Malware Detection
International Standard Book Number (ISBN)
International Standard Serial Number (ISSN)
Article - Conference proceedings
© 2011 Institute of Electrical and Electronics Engineers (IEEE), All rights reserved.
01 Jan 2011