Understanding Neuro-Fuzzy on a class of multinomial malware detection problems
Andrii Shalaginov, Lars Strande Grini, Katrin Franke · 2016
Malware classification has become an important task in protection of privacy and sensitive information from being stolen or modified. A number of malware categories and families emerged over last decade targeting Microsoft Windows since it is the most attractive platform for virus developers. Software for this OS is provided in a format of Portable Executable (PE) files. Majority of commercial anti-virus solutions use signature-based detection, where malware pattern is described by means of unique crisp identifier of corresponding PE file content. Neuro-Fuzzy is one of the prospective Hybrid Intelligence methods suitable for malware detection. Despite the fact that Neuro-Fuzzy is being utilized successfully for binary malware classification, it was not investigated in such complex cases as multinomial classification of malware categories and families. The advantage of this method is ability to produce generalized fuzzy rules model applicable for real-world application. For this study we created a novel large-scale malware dataset that include variety of malware samples. Moreover, reports from VirusTotal and PEframe were collected to PE header features and species naming used by major anti-virus vendors. Finally, we applied tuned Neuro-Fuzzy for handling multinomial problems. This paper contributes as a stepping stone for future analysis of aspects Neuro-Fuzzy methods for real-world malware classification.