.png){kind=icon}
返回
Boosting training for PDF malware classifier via active learning
.png){kind=icon}
OA
AI
DOI：10.1002/int.22451.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Machine learning algorithms are widely used for cybersecurity applications, include spam, malware detection. In these applications, the machine learning model has to face attack by adversarial samples. Therefore, how to train a robust machine learning model with small samples is a very hot research problem. portable document format (PDF) is a widely used file format, and often utilized as a vehicle for malicious behavior. There have been various PDF malware detectors based on machine learning. However, the labeling of large-scale data samples is time-consuming and laborious. This paper aims to reduce the size of training set while maintain the performance of detection. We propose a novel PDF malware detection method, using active learning to boost training. Particularly, we first make clear the meaning of uncertain samples in this paper, and theoretically explain the effectiveness of these uncertain samples for malware detection. Second, we present an active-learning based malware detection model, using mutual agreement analysis to choose the uncertain sample as the data augmentation. The detector is retrained according to the ground truth of the uncertain samples rather than the whole test samples in the previous epoch, which can not only improve the detection performance, but also reduce the training time consumption of the detector. We conduct 10 epochs of retraining experiments for comparison, using the uncertain samples and the whole test samples from the previous epoch respectively as training set augmentation. The experimental results show that our active-learning based model can achieve the same performance as the traditional model in the tenth epoch of retraining, while the former only needs to use one thirtieth of the latter's training samples.
Keyword:
active learning
machine learning
malware detection
PDF
期刊
IF:
3.7
论文数:
3.1K
被引数:
8.1K
机构
引用论文
Proteasome, but Not Autophagy, Disruption Results in Severe Eye and Wing Dysmorphia: A Subunit- and Regulator-Dependent Process in Drosophila.png)
PLoS ONEOAAI
PLoS ONEIF0
OAAI分享收藏A Survey on malware analysis and mitigation techniques恶意软件分析与缓解技术综述COMPUTER SCIENCE REVIEW
COMPUTER SCIENCE REVIEWIF12.7
PREAI
分享收藏
查看更多内容