一种基于MDL的事务数据集分类器及其在恶意软件检测中的应用
An MDL-Based Classifier for Transactional Datasets with Application in Malware Detection
摘要：
我们设计了一个用于恶意软件检测的事务数据集分类器。基于最小描述长度（MDL）原则构建分类器。这涉及到选择一个模型，考虑MDL标准，最好地压缩每个类的训练数据集。为了为数据集选择模型，我们首先使用聚类，然后使用闭合频繁模式挖掘来提取闭合频繁模式（CFPs）的子集。我们表明，这种方法作为一种模式总结方法，以避免模式爆炸，这是通过优先考虑较长的CFPs，而不需要提取所有CFPs。然后，我们使用MDL准则，进一步总结提取的模式，并构建一个代码表的模式。此代码表被视为用于数据集压缩的选定模型。我们评估我们的分类器的问题，在便携式可执行（PE）文件中的静态恶意软件检测。我们认为PE文件的API调用是它们的区别特征。API调用的存在和不存在形成了一个事务数据集。使用我们提出的方法，我们构建了两个代码表，一个用于良性训练数据集，一个用于恶意软件训练数据集。我们的数据集由19696个良性和19696个恶意软件样本组成，每个样本都是大小为22761的二进制序列。我们将我们的分类器与为我们提供最先进性能的深度神经网络进行比较。比较表明，我们的分类器的性能非常接近深度神经网络。我们还讨论了我们的分类器是一个可解释的分类器。这提供了使用这种类型的分类器的动机，其中需要某种程度的解释，为什么样本被分类在一个类别下，而不是另一个类别。
英文摘要：
We design a classifier for transactional datasets with application in malware detection. We build the classifier based on the minimum description length (MDL) principle. This involves selecting a model that best compresses the training dataset for each class considering the MDL criterion. To select a model for a dataset, we first use clustering followed by closed frequent pattern mining to extract a subset of closed frequent patterns (CFPs). We show that this method acts as a pattern summarization method to avoid pattern explosion; this is done by giving priority to longer CFPs, and without requiring to extract all CFPs. We then use the MDL criterion to further summarize extracted patterns, and construct a code table of patterns. This code table is considered as the selected model for the compression of the dataset. We evaluate our classifier for the problem of static malware detection in portable executable (PE) files. We consider API calls of PE files as their distinguishing features. The presence-absence of API calls forms a transactional dataset. Using our proposed method, we construct two code tables, one for the benign training dataset, and one for the malware training dataset. Our dataset consists of 19696 benign, and 19696 malware samples, each a binary sequence of size 22761. We compare our classifier with deep neural networks providing us with the state-of-the-art performance. The comparison shows that our classifier performs very close to deep neural networks. We also discuss that our classifier is an interpretable classifier. This provides the motivation to use this type of classifiers where some degree of explanation is required as to why a sample is classified under one class rather than the other class.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
