Malware is any type of malicious code that has the potential to harm a computer or network. The volume of malware is growing at a faster rate every year and poses a serious global security threat. Although signaturebased detection is the most widespread method used in commercial antivirus programs, it consistently fails to detect new malware. Supervised machinelearning models have been used to address this issue. However, the use of supervised learning is limited because it needs a large amount of malicious code and benign software to first be labelled. In this paper, we propose a new method that uses single-class learning to detect unknown malware families. This method is based on examining the frequencies of the appearance of opcode sequences to build a machine-learning classifier using only one set of labelled instances within a specific class of either malware or legitimate * Corresponding author Email addresses: isantos@deusto.es (Igor Santos), felix.brezo@deusto.es (Felix Brezo), borja.sanz@deusto.es (Borja Sanz), claorden@deusto.es (Carlos Laorden), pablo.garcia.bringas@deusto.es (Pablo G. Bringas) software. We performed an empirical study that shows that this method can reduce the effort of labelling software while maintaining high accuracy.
In a later paper, Santos et al. examined a SVM with a single-class learning approach that used the frequency of opcodes obtained from static analysis REF .
Using opcode sequences in single-class learning to detect unknown malware
IET Information Security
IET Information Security
Computer Science