Machine learning is one of the main strategies applied to malware detection in the literature, since machine learning models are more adaptive than signature based solutions. One of the main challenges in the application of machine learning to malware detection is the presence of concept drift, which is a change in the data distribution over time caused by the evolving nature of malware; for example, the development of new malware families. To tackle drift, online models that can be dynamically updated are applied. However, labelled data is needed to keep the model up to date and reliable labels are expensive to obtain. In this paper, we study the effectiveness of the application of transfer learning to improve model performance in malware detection. Transfer learning is based on exploiting knowledge of related datasets to improve predictions in a target dataset, and requires no labels in the target. Therefore, it may help to improve predictions on new malware families by making use of past data. The results show that transfer learning algorithms provide inconsistent performance that, despite significant improvements in some cases, does not extend to different models or algorithms.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Application of Transfer Learning to Online Models in Malware Detection

  • David Escudero García,
  • Noemí DeCastro-García

摘要

Machine learning is one of the main strategies applied to malware detection in the literature, since machine learning models are more adaptive than signature based solutions. One of the main challenges in the application of machine learning to malware detection is the presence of concept drift, which is a change in the data distribution over time caused by the evolving nature of malware; for example, the development of new malware families. To tackle drift, online models that can be dynamically updated are applied. However, labelled data is needed to keep the model up to date and reliable labels are expensive to obtain. In this paper, we study the effectiveness of the application of transfer learning to improve model performance in malware detection. Transfer learning is based on exploiting knowledge of related datasets to improve predictions in a target dataset, and requires no labels in the target. Therefore, it may help to improve predictions on new malware families by making use of past data. The results show that transfer learning algorithms provide inconsistent performance that, despite significant improvements in some cases, does not extend to different models or algorithms.