## 1 Introduction  
As the Internet becomes a critical piece of infrastructure for our lives, malware threats are increasing yearly. Malware steals confidential information, destroys important data, and sometimes uses the data as collateral for blackmail, money laundering, and other highly malicious crimes. In recent years, a large-scale distributed denial-of-service attack was carried out by exploiting IoT devices infected with a malware program called Mirai [1]. In 2017, a large number of computers around the world were infected with ransomware called WannaCry [2]. Furthermore, in 2022, a targeted attack by a malware application called Emotet was attached in phishing emails [3]. Although accurate and quick malware detection is essential, a single detection method can overlook the attack. The number of new malware attacks is constantly being observed each year according to the report [4]. This report indicates that the malware detection method should collect intelligence about new malware in real-time to respond to its activity. Many malware detection systems have been widely studied, but they can still overlook the malware depending on the type. Even today, as the accuracy of machine learning technology continues to improve, this method still has problems in terms of usability and safety. While collaborative malware detection has been widely studied to tackle the issue of hard-to-detect attacks [5; 6; 7; 8], they are still insufficient to detect new malware. These methods conduct voting based on the detection results obtained from multiple anti-virus vendors testing the same sample and use the majority result to determine the sample's maliciousness. While studies [5; 6; 7; 8] showed that this approach could detect malware more accurately than the results of a single anti-virus inspection, the majority decision would negatively impact the accuracy of the judgment. For example, even if reliable detection engines with high accuracy determine that a suspicious file is malware, the malware will be overlooked when most classifiers determine that the file is benign. Based on this concern, these majority-vote-based methods might miss the new type of malware because most anti-virus engines lack sufficient information to detect the new malware at that time. To consider the reliability of the anti-virus engines in a final decision, we weighted the voting value of malware detection by anti-virus engines according to their accuracy history. This method can be expected to improve the detection accuracy by reducing false negatives, that is, overlooked malware. This study mainly examined the accuracy of collaborative malware detection when weighting is set to the optimal setting based on VirusTotal results. To verify the actual detection accuracy against unknown malware, we used a malware repository service called MalwareBazaar. By inspecting malware registered in MalwareBazaar on the same day as it was registered, we simulatively measured the detection accuracy of unknown malware with insufficient information. The remainder of this paper is structured as follows. Section 2 describes the background for the research domain of malware detection. Section 3 provides the key concept, architecture, and detailed components of the proposed system. Section 4 reports the evaluation experiment for the proposed system, and Section 5 gives and discusses its results. Section 6 and Section 7 discuss the differences and originality of our work and the limitations on interpreting the detection results. In Section 8, we summarize this paper. The main contributions of this paper are as follows:  
* An investigation of the actual detection accuracy of each anti-virus engine on VirusTotal [9] using actual malware samples. Combining multiple anti-virus engines could improve detection accuracy based on the observation that each engine has different strengths when it comes to the various malware categories. * A demonstration of the potential of an optimal weighted-voting-based malware detection system to improve detection accuracy against unknown malware.