Malicious code detection using active learning

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

24 Scopus citations


The recent growth in network usage has motivated the creation of new malicious code for various purposes, including economic and other malicious purposes. Currently, dozens of new malicious codes are created every day and this number is expected to increase in the coming years. Today's signature-based anti-viruses and heuristic-based methods are accurate, but cannot detect new malicious code. Recently, classification algorithms were used successfully for the detection of malicious code. We present a complete methodology for the detection of unknown malicious code, inspired by text categorization concepts. However, this approach can be exploited further to achieve a more accurate and efficient acquisition method of unknown malicious files.We use an Active-Learning framework that enables the selection of the unknown files for fast acquisition. We performed an extensive evaluation of a test collection consisting of more than 30,000 files. We present a rigorous evaluation setup, consisting of real-life scenarios, in which the malicious file content is expected to be low, at about 10% of the files in the stream. We define specific evaluation measures based on the known precision and recall measures, which show the accuracy of the acquisition process and the improvement in the classifier resulting from the efficient acquisition process.

Original languageEnglish
Title of host publicationPrivacy, Security, and Trust in KDD - Second ACM SIGKDD International Workshop, PinKDD 2008, Revised Selected Papers
Number of pages18
StatePublished - 16 Jul 2009
Event2nd ACM SIGKDD International Workshop on Privacy, Security, and Trust in KDD, PinKDD 2008 - Las Vegas, NV, United States
Duration: 24 Aug 200827 Aug 2008

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume5456 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference2nd ACM SIGKDD International Workshop on Privacy, Security, and Trust in KDD, PinKDD 2008
Country/TerritoryUnited States
CityLas Vegas, NV


Dive into the research topics of 'Malicious code detection using active learning'. Together they form a unique fingerprint.

Cite this