Comparative analysis of voting schemes for ensemble-based malware detection

Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications

Volumn 4, Issue 1, 2013, Pages 98-117

  Shahzad, Raja Khurram ^a   Lavesson, Niklas ^a  

^a BLEKINGE INSTITUTE OF TECHNOLOGY   (Sweden)

Author keywords

Classification; Ensemble; Feature extraction; Majority voting; Malicious software; Malware detection; Scareware; Trust; Veto voting

Indexed keywords

EID: 84886870981     PISSN: 20935374     EISSN: 20935382     Source Type: Journal    
DOI: None     Document Type: Article

References (45)

1. R. K. Shahzad and N. Lavesson, Veto-based malware detection, in Proc. of the 7th International Conference on Availability, Reliability, and Security (ARES'12), Prague, Czech Republic. IEEE, August 2012, pp. 47-54.
2. L. Martignoni, E. Stinson, M. Fredrikson, S. Jha, and J. C. Mitchell, A layered architecture for detecting malicious behaviors, in Proc. of the 11th International Symposium on Recent Advances in Intrusion Detection (RAID'08), Cambridge, Massachusetts, USA, LNCS, vol. 5230. Springer-Verlag, September 2008, pp. 78-97.
3. Y. Sun, M. S. Kamel, and A. K. C. Wong, Empirical study on weighted voting multiple classifiers, in Proc. of the 3rd International Conference on Advances in Pattern Recognition and Data Mining (ICAPR'05), Bath, UK. Springer-Verlag, August 2005, pp. 335-344.
4. M. S. Kamel and N. M. Wanas, Data dependence in combining classifiers, in Proc. of the 4th International Conference on Multiple Classifier Systems (MCS'03), Guildford, UK, LNCS, vol. 2709. Springer-Verlag, June 2003, pp. 1-14.
5. L. Lam and S. Y. Suen, Application of majority voting to pattern recognition: an analysis of its behavior and performance, IEEE Transactions on Systems, Man, and Cybernetics, Part A: Systems and Humans, vol. 27, no. 5, pp. 553-568, 1997.
6. Y.-A. Sun and C. R. Dance, When majority voting fails: Comparing quality assurance methods for noisy human computation environment, Computing Research Repository, vol. 1204.3516, 2012.
7. C. Ren, J.-F. Yan, and Z.-H. Li, Improved ensemble learning in fault diagnosis system, in Proc. of the 2009 International Conference on Machine Learning and Cybernetics (ICMLC'09), Baoding, China. IEEE, July 2009, pp. 54-60.
8. W. Stallings, Network Security Essentials: Applications and Standards, 4th ed. Prentice Hall, 2011.
9. T. M. Mitchell, Machine Learning, 1st ed. McGraw-Hill, Inc., 1997.
10. I. H. Witten, E. Frank, and M. A. Hall, Data Mining: Practical Machine Learning Tools and Techniques, 3rd ed. Morgan Kaufmann Inc., 2011.
11. M. G. Schultz, E. Eskin, E. Zadok, and S. J. Stolfo, Data mining methods for detection of new malicious executables, in Proc. of the 2001 IEEE Symposium on Security and Privacy (S&P'01), Oakland, California, USA. IEEE, May 2001, pp. 38-49.
12. R. K. Shahzad, S. I. Haider, and N. Lavesson, Detection of spyware by mining executable files, in Proc. of the 5th International Conference on Availability, Reliability, and Security (ARES'05), Krakow, Poland. IEEE, February 2010.
13. R. K. Shahzad and N. Lavesson, Detecting scareware by mining variable length instruction sequences, in Proc. of the 10th Annual Information Security South Africa Conference (ISSA'11), Johannesburg, South Africa. IEEE, August 2011, pp. 1-8.
14. L. I. Kuncheva, Diversity in multiple classifier systems, Information Fusion, vol. 6, no. 1, pp. 3-4, 2005.
15. Trust management for internet applications, Ph.D. dissertation, Imperial College, 2003.
16. A. Gepperth, Object detection and feature base learning with sparse convolutional neural networks, in Proc. of the 2nd International conference on Artificial Neural Networks in Pattern Recognition (ANNPR'06), Ulm, Germany, LNCS, vol. 4087, August 2006, pp. 221-232.
17. D. Tikk, Z. T. Kardkovács, and F. P. Szidarovszky, Voting with a parameterized veto strategy: Solving the KDD cup 2006 problem by means of a classifier committee, ACM Special Interest Group on Knowledge Discovery and Data Mining Explorations, vol. 8, no. 2, pp. 53-62, 2006.
18. R. Kern, C. Seifert, M. Zechner, and M. Granitzer, Vote/veto meta-classifier for authorship identification notebook for pan, in Proc. of the Conference on Multilingual and Multimodal Information Access Evaluation (CLEF'11), Amsterdam, Netherlands, September 2011.
19. E. Menahem, A. Shabtai, L. Rokach, and Y. Elovici, Improving malware detection by applying multi-inducer ensemble, Computational Statistics & Data Analysis, vol. 53, no. 4, pp. 1483-1494, 2009.
20. B. Zhang, J. Yin, J. Hao, D. Zhang, and S. Wang, Malicious codes detection based on ensemble learning, in Proc. of the 4th International Conference on Autonomic and Trusted Computing (ATC'07), Hong Kong, China, LNCS, vol. 4610. Springer-Verlag, July 2007, pp. 468-477.
21. R. Moskovitch, D. Stopel, C. Feher, N. Nissim, and Y. Elovici, Unknown malcode detection via text categorization and the imbalance problem, in Proc. of the 2008 International Conference on Intelligence and Security Informatics (ISI'08), Taipei, Taiwan. IEEE, June 2008, pp. 156-61.
22. T. Beth, M. Borcherding, and B. Klein, Valuation of trust in open networks, in Proc. of the 3rd European Symposium on Research in Computer Security (ESORICS'94), Brighton, UK, LNCS, vol. 875. SpringerVerlag, November 1994, pp. 3-18.
23. M. K. Reiter and S. G. Stubblebine, Path independence for authentication in large-scale systems, in Proc. of the ACM Conference on Computer and Communications Security (CCS'97), Zurich, Switzerland. ACM, April 1997, pp. 57-66.
24. R. Levien, Attack resistant trust metrics, UC Berkeley, Tech. Rep., 2004.
25. R. Levien, Attack-resistant trust metrics, in Computing with Social Trust. Springer-Verlag, 2009, pp. 121-132.
26. S. D. Kamvar, M. T. Schlosser, and H. Garcia-Molina, The eigentrust algorithm for reputation management in P2P networks, in Proc. of the 12th International Conference on World Wide Web (WWW'03), Budapest, Hungary. ACM, May 2003.
27. Z. Abrams, R. McGrew, and S. Plotkin, A non-manipulable trust system based on eigentrust, Special Interest Group on Electronic Commerce Exchanges, vol. 5, no. 4, pp. 21-30, 2005.
28. X. Li, J. Slay, and S. Yu, Evaluating trust in mobile ad hoc networks, in Proc. of the Workshop of International Conference on Computational Intelligence and Security (CIS'05), Xi'an, China, LNCS, vol. 380. Springer-Verlag, December 2005.
29. X. Liu, G. Trédan, and A. Datta, A generic trust framework for large-scale open systems using machine learning, Computing Research Repository, vol. 1103.0086, 2011.
30. S. M. Weiss, C. Apte, F. J. Damerau, D. E. Johnson, F. J. Oles, T. Goetz, and T. Hampp, Maximizing text-mining performance, IEEE Intelligent Systems and their Applications, vol. 14, no. 4, pp. 63-69, 1999.
31. G. Giacinto and F. Roli, Methods for dynamic classifier selection, in Proc. of the 10th International Conference on Image Analysis and Processing (ICIAP'99), Venice, Italy. IEEE, September 1999, pp. 659-664.
32. A. Santana, R. G. F. Soares, A. M. P. Canuto, and M. C. P. d. Souto, A dynamic classifier selection method to build ensembles using accuracy and diversity, in Proc. of the 9th Brazilian Symposium on Neural Networks (SBRN'06), Ribeirão Petro, Brazil. IEEE, October 2006, pp. 36-41.
33. F. Talib, Computational aspects of voting: A literature survey, Master's thesis, Rochester Institute of Technology, Rochester, USA, 2007.
34. H. Moulin, Voting with proportional veto power, Econometrica, vol. 50, no. 1, pp. 145-62, 1982.
35. M. Hall, E. Frank, G. Holmes, B. Pfahringer, P. Reutemann, and I. H. Witten, The WEKA data mining software: an update, ACM Special Interest Group on Knowledge Discovery and Data Mining Explorations, vol. 11, pp. 10-18, 2009.
36. R. Moskovitch, C. Feher, N. Tzachar, E. Berger, M. Gitelman, S. Dolev, and Y. Elovici, Unknown malcode detection using OPCODE representation, in Proc. of the 1st European Conference on Intelligence and Security Informatics (EuroISI'08), Esbjerg, Denmark, LNCS, vol. 5376. Springer-Verlag, December 2008, pp. 204-215.
37. G. Salton and C. Buckley, Term-weighting approaches in automatic text retrieval, Information Processing and Managment, vol. 24, no. 5, pp. 513-523, August 1988.
38. W. W. Cohen, Fast effective rule induction, in Proc. of 12th International Conference on Machine Learning (ICML'95), California, USA. Morgan Kaufmann Publishers Inc., July 1995, pp. 115-23.
39. J. R. Quinlan, C4.5: programs for machine learning. Morgan Kaufmann Publishers Inc., 1993.
40. T. M. Cover and P. E. Hart, Nearest neighbor pattern classification, IEEE Transactions on Information Theory, vol. 13, no. 1, pp. 21-27, 1967.
41. J. Platt, Sequential minimal optimization: A fast algorithm for training support vector machines, Advances in Kernel Methods-Support Vector Learning, vol. 208, pp. 98-112, 1999.
42. R. H. Walpole, Ronald E., Myers and S. L. Myers, Probability & Statistics for Engineers & Scientists. Prentice Hall, 2012.
43. J. Franke, L. Lam, R. Legault, C. P. Nadal, and C. Y. Suen, Experiments with the CENPARMI data base combining different classification approaches, in Proc. of the 3rd International Workshop on Frontiers in Handwriting Recognition (ICFHR'93), Buffalo, New York, USA, May 1993, pp. 305-311.
44. A. F. R. Rahman, H. Alam, and M. C. Fairhurst, Multiple classifier combination for character recognition: Revisiting the majority voting system and its variations, in Proc. of the 5th International Workshop on Document Analysis Systems (DAS'02). Princeton, USA, LNCS, vol. 2423. Springer-Verlag, August 2002, pp. 167-178.
45. D. Ruta and G. Bogdan, Classifier selection for majority voting, Information Fusion, vol. 6, no. 1, pp. 63-81, 2005.