## 3 Proposed Method
### Malware Detection Algorithm
#### 3.3.2 Assignment of Appropriate Weights  
In this study, we introduced a method of weighting the detection results output from anti-virus engines by applying an appropriate weight value according to the analysis history. The proposed system sets different priorities at multiple levels depending on the contents of the detection results output by each anti-virus engine.  
To reflect the reliability of detection results, the proposed system uses a weight matrix \(W\in\mathbb{R}^{C\times K}\), where \(C\) is the total number of malware categories handled and \(K\) is the total number of active anti-virus engines. The malicious voting weight for category \(c\) of the \(k\)-th anti-virus engine \(W_{\text{ck}}\) takes three weighting levels \(w_{\text{high}}>w_{\text{mid}}>w_{\text{low}}\). If an anti-virus engine provides a binary-category classification rather than a multi-category classification, the system assigns the same weight to all categories.  
The three weighting levels are assigned by Equation (1) based on the detection rate \(R_{\text{ck}}\). \(R_{\text{ck}}\) is a value that indicates the performance of anti-virus engines, which is calculated  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Notation** & **Description** \\ \hline \(C\) & Total number of malware categories handled \\ \hline \(K\) & Total number of active anti-virus engines \\ \hline \(M\) & Anomaly score calculated by the proposed system \\ \hline \(T\) & Threshold for the anomaly score \\ \hline \(V_{\text{b}}\) & Total score of benign judgment votes \\ \hline \(V_{\text{m}}\) & Total score of malicious judgment votes \\ \hline \(W\) & Weight matrix (\(W\in\mathbb{R}^{C\times K}\)) \\ \hline \(w_{\text{high}},w_{\text{mid}},w_{\text{low}}\) & Weights of vote, \(w_{\text{high}}>w_{\text{mid}}>w_{\text{low}}\) \\ \hline \(D_{\text{high}},D_{\text{low}}\) & Criterion for assigning vote weights for the detection rate \\ \hline \(S_{\text{high}},S_{\text{low}}\) & Criterion for assigning vote weights for the anomaly score \\ \hline \(R_{\text{ck}}\) & Detection rate for category \(c\), which is from the \(k\)-th anti-virus engine (\(R_{\text{ck}}\in[0,1]\)) \\ \hline \(\delta\) & Normalized anomaly score \(s\) from the anti-virus engine \\ \hline \hline \end{tabular}
\end{table}
Table 1: Notation used in Section 3.  
in advance by attempting the detection process against a set of binary files whose true categories are already known.  
\[W_{\text{ck}}=\begin{cases}w_{\text{low}}&\text{if }0\leq R_{\text{ck}}<D_{ \text{low}},\\ w_{\text{mid}}&\text{if }D_{\text{low}}\leq R_{\text{ck}}<D_{\text{high}},\\ w_{\text{high}}&\text{if }D_{\text{high}}\leq R_{\text{ck}}\leq 1.\end{cases} \tag{1}\]  
The metrics that can be used as \(R_{\text{ck}}\) are not limited to any specific one if they are related to detection performance. The system administrator might adopt the recall to reduce false negatives, the F-value to balance precision and recall, or some other metric.  
Unfortunately, this rule alone does not allow for the calculation of weights when the reported malware category is not included in the set of categories maintained by the system. In this case, the system takes the following measures to make the results as useful as possible. Some anti-virus engines using machine learning techniques might calculate the anomaly score \(s\). If the anomaly score is included in the anti-virus engine response, \(W_{\text{ck}}\) is assigned a weight value by Equation (2) where \(\delta\) is normalized \(s\) to the range of \([0,1]\). If there is no anomaly score response, \(W_{\text{ck}}\) is assigned \(w_{\text{low}}\).  
\[W_{\text{ck}}=\begin{cases}w_{\text{low}}&\text{if }0\leq\delta<S_{\text{low}},\\ w_{\text{mid}}&\text{if }S_{\text{low}}\leq\delta<S_{\text{high}},\\ w_{\text{high}}&\text{if }S_{\text{high}}\leq\delta\leq 1.\end{cases} \tag{2}\]