technical-note

On the appropriateness of evolutionary rule learning algorithms for malware detection

Authors:

M. Zubair Shafiq,

S. Momina Tabish,

Muddassar FarooqAuthors Info & Claims

GECCO '09: Proceedings of the 11th Annual Conference Companion on Genetic and Evolutionary Computation Conference: Late Breaking Papers

Pages 2609 - 2616

https://doi.org/10.1145/1570256.1570370

Published: 08 July 2009 Publication History

Abstract

In this paper, we evaluate the performance of ten well-known evolutionary and non-evolutionary rule learning algorithms. The comparative study is performed on a real-world classification problem of detecting malicious executables. The executable dataset, used in this study, consists of 189 attributes which are statically extracted from the executables of Microsoft Windows operating system. In our study, we compare the performance of rule learning algorithms with respect to four metrics: (1) classification accuracy, (2) the number of rules in the developed rule set, (3) the comprehensibility of the generated rules, and (4) the processing overhead of the rule learning process. The results of our comparative study suggest that evolutionary rule learning classifiers cannot be deployed in real-world malware detection systems.

References

[1]

]]J.H. Holland, L.B. Booker, M. Colombetti, M. Dorigo, D.E. Goldberg, S. Forrest, R.L. Riolo, R.E. Smith, P.L. Lanzi, W. Stolzmann, S.W. Wilson, "What Is a Learning Classifier System?", Internatinoal Workshop on Learning Classifier Systems (IWLCS), Volume 1813 of Lecture Notes in Artificial Intelligence, pp. 3--32, Springer, 2000.

Digital Library

[2]

]]S.W. Wilson, "Classifier fitness based on accuracy", Evolutionary Computation, 3(2), pp. 149--175, MIT Press, 1995.

Digital Library

[3]

]]E.B. Mansilla, J.M.G. Guiu, "Accuracy-Based Learning Classifier Systems: Models, Analysis and Applications to Classification Tasks Ester", Evolutionary Computation, 11(3), pp. 209--238, MIT Press, 2006.

Digital Library

[4]

]]J. Bacardit, J.M. Garrell, "Evolving Multiple Discretizations with Adaptive Intervals for a Pittsburgh Rule-Based Learning Classifier System", Genetic and Evolutionary Computation Conference (GECCO), Volume 2724 of Lecture Notes in Computer Science, pp. 1818--1831, Springer, USA, 2003.

Digital Library

[5]

]]J. Bacardit, J.M. Garrell, "Bloat control and generalization pressure using the minimum description length principle for a Pittsburgh approach Learning Classifier System", International Workshop on Learning Classifier Systems (IWLCS), Volume 4399 of Lecture Notes in Artificial Intelligence, pp. 59--79, Springer, UK, 2007.

Digital Library

[6]

]]A. Gonzalez, R. Perez, "SLAVE: A genetic learning system based on an iterative approach", IEEE Transactions on Fuzzy Systems, 7(2), pp. 176--191, 1999.

Digital Library

[7]

]]W.W. Cohen, "Fast Effective Rule Induction", 12th International Conference on Machine Learning (ICML), pp. 115--123, Morgan Kaufmann, USA, 1995.

[8]

]]W.W. Cohen, Y. Singer, "A simple, fast, and effective rule learner", 16th National Conference on Artificial Intelligence, pp. 335--342, American Association for Artificial Intelligence (AAAI), USA, 1999.

Digital Library

[9]

]]E. Frank, I.H. Witten, "Generating accurate rule sets without global optimization", 15th International Conference on Machine Learning (ICML), pp. 144--151, Morgan Kaufmann, USA, 1998.

Digital Library

[10]

]]J.R. Quinlan, "MDL and Categorical Theories (Continued)", 12th International Conference on Machine Learning (ICML), pp. 464--470, Morgan Kaufmann, USA, 1995.

[11]

]]G. Gora, A. Wojna, "RIONA: A New Classification System Combining Rule Induction and Instance-Based Learning", Fundamenta Informaticae, 51(4), pp. 369--390, IOS Press, 2002.

Digital Library

[12]

]]A.O. Puig, J. Casillas, E.B. Mansilla, "Genetic-based machine learning systems are competitive for pattern recognition", Evolutioanry Intelligence, 1(3), pp. 209--232, Springer, 2008.

[13]

]]J. Bacardit, M.V. Butz, "Data Mining in Learning Classifier Systems: Comparing XCS with GAssist", International Workshop on Learning Classifier Systems (IWLCS), Volume 4399 of Lecture Notes in Artificial Intelligence, pp. 282--290, Springer, UK, 2007.

Digital Library

[14]

]]E. Bernado, X. Llora, J.M. Garrell, "XCS and GALE: a Comparative Study of Two Learning Classifier Systems with Six Other Learning Algorithms on Classification Tasks", Advances in Learning Classifier Systems, Volume 2321 of Lecture Notes in Computer Science, pp. 115--132, Springer, 2002.

Digital Library

[15]

]]F. Kharbat, L. Bull, M. Odeh, "Mining Breast Cancer Data with XCS", Genetic and Evolutionary Computation Conference (GECCO), pp. 2066--2073, ACM Press, UK, 2007.

Digital Library

[16]

]]A.O. Puig, E.B. Mansilla, "Evolutionary rule-based systems for imbalanced data sets", Soft Computing -- A Fusion of Foundations, Methodologies and Applications, 13(3), pp. 213--225, Springer, 2008.

Digital Library

[17]

]]K. Shafi, T. Kovacs, H.A. Abbass, W. Zhu, "Intrusion detection with evolutionary learning classifier systems", Natural Computing, Springer, 2007.

Digital Library

[18]

]]K.C. Tan, Q. Yu, C.M. Heng, T.H. Lee, "Evolutionary computing for knowledge discovery in medical diagnosis", Artificial Intelligence in Medicine, 27(2), pp. 129--154, Elsevier, 2003.

Digital Library

[19]

]]Y. Gao, J.Z. Huang, H. Rong, D.Q. Gu, "LCSE: Learning Classifier System Ensemble for Incremental Medical Instances", International Workshop on Learning Classifier Systems (IWLCS), Volume 4399 of Lecture Notes in Computer Science, pp. 93--103, Springer, UK, 2007.

Digital Library

[20]

]]J. Alcala-Fdez, L. Sanchez, S. Garcia, M.J. del Jesus, S. Ventura, J.M. Garrell, J. Otero, C. Romero, J. Bacardit, V.M. Rivas, J.C. Fernandez, F. Herrera, "KEEL: a software tool to assess evolutionary algorithms for data mining problems", Soft Computing, Volume 13, pp. 307--318, Springer, 2009.

Digital Library

[21]

]]C. Blake, E. Keogh, C. Merz, "UCI repository of machine learning databases", 1998, available at www.ics.uci.edu/mlearn/MLRepository.html.

[22]

]]R. Rivest, "Learning Decision Trees", Machine Learning, Vol. 2, pp. 229--246, 1987.

Digital Library

[23]

]]S.W. Wilson, "Compact rulesets from XCSI", International Workshop on Advances in Learning Classifier Systems, Volume 2321 of Lecture Notes in Artificial Intelligence, pp. 197--210, Springer, 2002.

Digital Library

[24]

]]P.W. Dixon, D.W. Corne, M.J. Oates, "A ruleset reduction algorithm for the XCSI Learning Classifier System", Volume 2661 of Lecture Notes in Computer Science, pp. 20--29, Springer, 2004.

[25]

]]C. Fu, L. Davis, "A modified classifier system compaction algorithm", Genetic and Evolutionary Computation Conference (GECCO), pp. 920--925, Morgan Kaufmann, USA, 2002.

[26]

]]A.O. Puig, E.B. Mansilla, "Analysis of reduction algorithms for XCS classifier system", Recent Advances in Artificial Intelligence Research and Development, pp. 383--390, IOS Press, 2004.

[27]

]]Microsoft Portable Executable and Common Object File Format Specification, Windows Hardware Developer Central, Updated March 2008.

[28]

]]F-Secure Virus Description Database, available at http://www.f-secure.com/v-descs/.

[29]

]]T.M. Cover, J.A. Thomas, "Elements of Information Theory", Wiley-Interscience, 1991.

Digital Library

[30]

]]VX Heavens Virus Collection, VX Heavens website, available at http://vx.netlux.org.

Cited By

Benchea RGavrilut DLuchian H(2017)Feature Creation Using Genetic Algorithms for Zero False Positive Malware ClassificationEVOLVE - A Bridge between Probability, Set Oriented Numerics, and Evolutionary Computation VI10.1007/978-3-319-69710-9_6(82-93)Online publication date: 11-Nov-2017
https://doi.org/10.1007/978-3-319-69710-9_6
Wuchner TOchoa MLovat EPretschner A(2016)Generating behavior-based malware detection models with genetic programming2016 14th Annual Conference on Privacy, Security and Trust (PST)10.1109/PST.2016.7907008(506-511)Online publication date: Dec-2016
https://doi.org/10.1109/PST.2016.7907008
Vatamanu CGavrilut DBenchea RLuchian H(2015)Feature Extraction Using Genetic Programming with Applications in Malware DetectionProceedings of the 2015 17th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC)10.1109/SYNASC.2015.43(224-231)Online publication date: 21-Sep-2015
https://dl.acm.org/doi/10.1109/SYNASC.2015.43
Show More Cited By

Index Terms

On the appropriateness of evolutionary rule learning algorithms for malware detection
1. Computing methodologies
  1. Machine learning
    1. Machine learning approaches
      1. Logical and relational learning
        Inductive logic learning
2. Security and privacy
  1. Intrusion/anomaly detection and malware mitigation
  2. Systems security
    1. Operating systems security

Recommendations

Are evolutionary rule learning algorithms appropriate for malware detection?
GECCO '09: Proceedings of the 11th Annual conference on Genetic and evolutionary computation

In this paper, we evaluate the performance of ten well-known evolutionary and non-evolutionary rule learning algorithms. The comparative study is performed on a real-world classification problem of detecting malicious executables. The executable dataset,...
Adaptive Rule-Based Malware Detection Employing Learning Classifier Systems: A Proof of Concept
COMPSACW '11: Proceedings of the 2011 IEEE 35th Annual Computer Software and Applications Conference Workshops

Efficient and accurate malware detection is increasingly becoming a necessity for society to operate. Existing malware detection systems have excellent performance in identifying known malware for which signatures are available, but poor performance in ...
Explainable Machine Learning For Malware Detection Using Ensemble Bagging Algorithms
IC3-2022: Proceedings of the 2022 Fourteenth International Conference on Contemporary Computing

Vulnerabilities in various software products can be used to attack the security systems in any organization anywhere. Malware is downloaded after a click on the hyperlink by the unsuspecting user and used as the exploitation tool for the vulnerabilities ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

GECCO '09: Proceedings of the 11th Annual Conference Companion on Genetic and Evolutionary Computation Conference: Late Breaking Papers

July 2009

1760 pages

ISBN:9781605585055

DOI:10.1145/1570256

General Chair:
Franz Rothlauf
University of Mainz, Germany

Copyright © 2009 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 08 July 2009

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Technical-note

Conference

GECCO09

Sponsor:

GECCO09: Genetic and Evolutionary Computation Conference

July 8 - 12, 2009

Québec, Montreal, Canada

Acceptance Rates

Overall Acceptance Rate 1,669 of 4,410 submissions, 38%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

6
Total Citations
View Citations
378
Total Downloads

Downloads (Last 12 months)1
Downloads (Last 6 weeks)0

Reflects downloads up to 07 Nov 2024

Other Metrics

View Author Metrics

Citations

Cited By

Benchea RGavrilut DLuchian H(2017)Feature Creation Using Genetic Algorithms for Zero False Positive Malware ClassificationEVOLVE - A Bridge between Probability, Set Oriented Numerics, and Evolutionary Computation VI10.1007/978-3-319-69710-9_6(82-93)Online publication date: 11-Nov-2017
https://doi.org/10.1007/978-3-319-69710-9_6
Wuchner TOchoa MLovat EPretschner A(2016)Generating behavior-based malware detection models with genetic programming2016 14th Annual Conference on Privacy, Security and Trust (PST)10.1109/PST.2016.7907008(506-511)Online publication date: Dec-2016
https://doi.org/10.1109/PST.2016.7907008
Vatamanu CGavrilut DBenchea RLuchian H(2015)Feature Extraction Using Genetic Programming with Applications in Malware DetectionProceedings of the 2015 17th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC)10.1109/SYNASC.2015.43(224-231)Online publication date: 21-Sep-2015
https://dl.acm.org/doi/10.1109/SYNASC.2015.43
Rafique MChen PHuygens CJoosen WArnold D(2014)Evolutionary algorithms for classification of malware families through different network behaviorsProceedings of the 2014 Annual Conference on Genetic and Evolutionary Computation10.1145/2576768.2598238(1167-1174)Online publication date: 12-Jul-2014
https://dl.acm.org/doi/10.1145/2576768.2598238
Blount JTauritz DMulder S(2011)Adaptive Rule-Based Malware Detection Employing Learning Classifier SystemsProceedings of the 2011 IEEE 35th Annual Computer Software and Applications Conference Workshops10.1109/COMPSACW.2011.28(110-115)Online publication date: 18-Jul-2011
https://dl.acm.org/doi/10.1109/COMPSACW.2011.28
Kim KMoon BPelikan MBranke J(2010)Malware detection based on dependency graph using hybrid genetic algorithmProceedings of the 12th annual conference on Genetic and evolutionary computation10.1145/1830483.1830703(1211-1218)Online publication date: 7-Jul-2010
https://dl.acm.org/doi/10.1145/1830483.1830703

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents