4.4 Article

Malware detection using bilayer behavior abstraction and improved one-class support vector machines

Journal

INTERNATIONAL JOURNAL OF INFORMATION SECURITY
Volume 15, Issue 4, Pages 361-379

Publisher

SPRINGER
DOI: 10.1007/s10207-015-0297-6

Keywords

Malware detection; Behavior feature extraction; Machine learning; One-class classification

Funding

  1. National Natural Science Foundations of China [61472302, 61272280, U1404620, 41271447, 61272195]
  2. Program for New Century Excellent Talents in University [NCET-12-0919]
  3. Fundamental Research Funds for the Central Universities [K5051203020, K5051303016, K5051303018, BDY081422, K50513100006]
  4. Natural Science Foundation of Shaanxi Province [2014JM8310]
  5. Creative Project of the Science and Technology State of Xi'an [CXY1341(6), CXY1440(1)]
  6. State Key Laboratory of Geo-information Engineering [SKLGIE2014-M-4-4]

Ask authors/readers for more resources

Malware detection is one of the most challenging problems in computer security. Recently, methods based on machine learning are very popular in unknown and variant malware detection. In order to achieve a successful learning, extracting discriminant and stable features is the most important prerequisite. In this paper, we propose a bilayer behavior abstraction method based on semantic analysis of dynamic API sequences. Operations on sensitive system resources and complex behaviors are abstracted in an interpretable way at different semantic layers. At the lower layer, raw API calls are combined to abstract low-layer behaviors via data dependency analysis. At the higher layer, low-layer behaviors are further combined to construct more complex high-layer behaviors with good interpretability. The extracted low-layer and high-layer behaviors are finally embedded into a high-dimensional vector space. Hence, the abstracted behaviors can be directly used by many popular machine learning algorithms. Besides, to tackle the problem that benign programs are not adequately sampled or malware and benign programs are severely imbalanced, an improved one-class support vector machine (OC-SVM) named OC-SVM-Neg is proposed which makes use of the available negative samples. Experimental results show that the proposed feature extraction method with OC-SVM-Neg outperforms binary classifiers on the false alarm rate and the generalization ability.

Authors

I am an author on this paper
Click your name to claim this paper and add it to your profile.

Reviews

Primary Rating

4.4
Not enough ratings

Secondary Ratings

Novelty
-
Significance
-
Scientific rigor
-
Rate this paper

Recommended

Article Engineering, Electrical & Electronic

SACF-Net: Skip-Attention Based Correspondence Filtering Network for Point Cloud Registration

Yue Wu, Xidao Hu, Yue Zhang, Maoguo Gong, Wenping Ma, Qiguang Miao

Summary: In this paper, a skip-attention based correspondence filtering network (SACF-Net) is proposed for point cloud registration. It utilizes a feature interaction mechanism and attention mechanism to extract high-quality correspondences from different resolutions of the encoder, leading to unprecedented performance improvements on indoor and outdoor scene datasets.

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS FOR VIDEO TECHNOLOGY (2023)

Article Computer Science, Software Engineering

Vehicle Trajectory Anomaly Detection Based on Reconstruction Error

Chaoneng Li, Guanwen Feng, Yiran Jia, Yunan Li, Jian Ji, Qiguang Miao

Summary: Due to the advancement of wireless sensor and location technologies, a significant amount of mobile agent trajectory data is now available. The authors propose an unsupervised reconstruction error-based trajectory anomaly detection (RETAD) method for vehicles, which addresses the limitations of conventional anomaly detection methods. RETAD utilizes an autoencoder based on recurrent neural networks to reconstruct the original vehicle trajectories. Experimental results demonstrate that RETAD outperforms traditional distance-based, density-based, and machine learning classification algorithms in detecting anomalies.

INTERNATIONAL JOURNAL OF DATA WAREHOUSING AND MINING (2023)

Article Computer Science, Artificial Intelligence

Focus on hierarchical features: Soft-weighted hierarchical features network

Hongkai Lin, Wentian Xin, Shun Chang, Qianxue Yang, Qiguang Miao, Ruyi Liu, Liang Chang

Summary: This paper proposes a novel network structure, SWHF-Net, to address the issues in semantic segmentation, including underutilization of backbone-derived features and mismatch between small objects and large-scale encodings. SWHF-Net consists of ST-FPM and HF2M modules, which utilize feature transformation and hierarchical fusion to improve the semantic representation of multi-scale objects and enhance computational efficiency.

NEUROCOMPUTING (2023)

Article Computer Science, Artificial Intelligence

Deep mutual learning for brain tumor segmentation with the fusion network

Huan Gao, Qiguang Miao, Daikai Ma, Ruyi Liu

Summary: This paper introduces a deep mutual learning strategy to address the extreme data imbalance in brain tumor segmentation. The proposed method combines transformer layers in both the encoder and decoder of a U-Net architecture. Experimental results show that the method achieves significant performance gain over existing methods.

NEUROCOMPUTING (2023)

Article Computer Science, Artificial Intelligence

Personalized recommendation with hybrid feedback by refining implicit data

Junmei Feng, Kunwei Wang, Qiguang Miao, Yue Xi, Zhaoqiang Xia

Summary: This paper proposes a hybrid-feedback collaborative filtering model that addresses the absence problem of negative feedback in the Bayesian personalized ranking (BPR) model by jointly exploiting explicit and implicit feedback. The model successfully extracts both implicit and explicit feedback features, and achieves competitive performance on public datasets.

EXPERT SYSTEMS WITH APPLICATIONS (2023)

Article Engineering, Electrical & Electronic

INENet: Inliers Estimation Network With Similarity Learning for Partial Overlapping Registration

Yue Wu, Yue Zhang, Xiaolong Fan, Maoguo Gong, Qiguang Miao, Wenping Ma

Summary: Point cloud registration is a crucial problem in computer vision for applications in robotics and autopilot. This paper proposes a learning-based approach called INENet, which utilizes a threshold prediction network and a probability estimation network to find the overlapping area of point clouds. The advantages of this approach include automatic threshold calculation, information fusion, and easy integration, as demonstrated by experimental results.

IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS FOR VIDEO TECHNOLOGY (2023)

Article Computer Science, Software Engineering

A Calibrated Force-Based Model for Mixed Traffic Simulation

Qianwen Chao, Pengfei Liu, Yi Han, Yingying Lin, Chaoneng Li, Qiguang Miao, Xiaogang Jin

Summary: An all-in-one traffic simulator that considers the complex behaviors of all potential road users in a realistic urban environment is urgently needed. In this work, a novel and extensible method using the force-based concept is proposed to build a heterogeneous traffic simulation. The effectiveness of this approach is demonstrated through many simulation experiments and comparisons to real-world traffic data and popular microscopic simulators.

IEEE TRANSACTIONS ON VISUALIZATION AND COMPUTER GRAPHICS (2023)

Article Radiology, Nuclear Medicine & Medical Imaging

Relaxation spectral analysis in multi-contrast vascular magnetic particle imaging

Xin Feng, Guang Jia, Jiaming Peng, Liyu Huang, Xiaofeng Liang, Haoran Zhang, Yanjun Liu, Bo Zhang, Yifei Zhang, Meng Sun, Peng Li, Qiguang Miao, Ying Wang, Li Xi, Kai Hu, Tanping Li, Hui Hui, Jie Tian

Summary: This study developed a multi-exponential relaxation spectral analysis method to separately measure the Neel and Brownian relaxation times in the magnetization recovery process in pulsed vascular MPI.

MEDICAL PHYSICS (2023)

Article Computer Science, Artificial Intelligence

Transformer for Skeleton-based action recognition: A review of recent advances

Wentian Xin, Ruyi Liu, Yi Liu, Yu Chen, Wenxin Yu, Qiguang Miao

Summary: Skeleton-based action recognition is a popular and important research topic in computer vision, aiming to classify human behaviors accurately through analyzing the characteristics of human joints with deep learning technology. Skeleton data has several advantages and is especially suitable for deep learning research in low-resource environments.

NEUROCOMPUTING (2023)

Article Environmental Sciences

RoadFormer: Road Extraction Using a Swin Transformer Combined with a Spatial and Channel Separable Convolution

Xiangzeng Liu, Ziyao Wang, Jinting Wan, Juli Zhang, Yue Xi, Ruyi Liu, Qiguang Miao

Summary: In this paper, a novel model named RoadFormer is proposed to accurately detect and extract roads using remote sensing technology. The model adopts a Swin Transformer as the backbone to effectively extract long-range information, and incorporates innovative bottleneck modules and a lightweight decoder to enhance feature representation and generate extraction results. Experimental results demonstrate the advantages of RoadFormer over comparable methods on the Deepglobe and Massachusetts datasets.

REMOTE SENSING (2023)

Article Environmental Sciences

CoDerainNet: Collaborative Deraining Network for Drone-View Object Detection in Rainy Weather Conditions

Yue Xi, Wenjing Jia, Qiguang Miao, Junmei Feng, Xiangzeng Liu, Fei Li

Summary: Benefiting from the advances in object detection in remote sensing, this study proposes a Collaborative Deraining Network (CoDerainNet) that simultaneously trains a deraining subnetwork and a droneDet subnetwork to improve the accuracy of object detection in rainy weather conditions (Rainy DroneDet). Additionally, a Collaborative Teaching paradigm (ColTeaching) is introduced to remove rain-specific interference and improve detection performance. Experimental results show that CoDerainNet can reduce computational costs while maintaining comparable detection performance to state-of-the-art models.

REMOTE SENSING (2023)

Article Computer Science, Artificial Intelligence

Seeking a Hierarchical Prototype for Multimodal Gesture Recognition

Yunan Li, Tianyu Qi, Zhuoqi Ma, Dou Quan, Qiguang Miao

Summary: Gesture recognition has received significant attention for its wide range of applications. Previous works have focused on distinguishing different gesture classes, while ignoring the impact of within-class differences caused by gesture-irrelevant factors. In multimodal gesture recognition, fusion of features or scores is a common choice, but it often leads to redundancy in gesture-relevant features across different modalities. To address these issues, a hierarchical gesture prototype framework is proposed to highlight gesture-relevant features such as poses and motions. The framework consists of a sample-level prototype and a modal-level prototype, which effectively avoids the influence of irrelevant factors and leverages the complementarity of modalities.

IEEE TRANSACTIONS ON NEURAL NETWORKS AND LEARNING SYSTEMS (2023)

Article Environmental Sciences

SRTPN: Scale and Rotation Transform Prediction Net for Multimodal Remote Sensing Image Registration

Xiangzeng Liu, Xueling Xu, Xiaodong Zhang, Qiguang Miao, Lei Wang, Liang Chang, Ruyi Liu

Summary: This paper proposes a scale and rotate transform prediction net to alleviate the effect of large geometric distortion in multimodal remote sensing image registration. The image scale regression module is constructed to reduce the scale between the reference and sensed images, and the rotation estimate module is developed to predict the rotation angles. Experimental results show the superior performance of the proposed method.

REMOTE SENSING (2023)

Article Computer Science, Artificial Intelligence

Evolutionary Multitasking With Solution Space Cutting for Point Cloud Registration

Yue Wu, Peiran Gong, Maoguo Gong, Hangqi Ding, Zedong Tang, Yibo Liu, Wenping Ma, Qiguang Miao

Summary: This study proposes a novel evolving registration algorithm via evolutionary multi-task optimization, which enhances escape from local optima and improves successful registration ratio. Experimental results demonstrate that the proposed method has superior performances in terms of precision and tackling local optima.

IEEE TRANSACTIONS ON EMERGING TOPICS IN COMPUTATIONAL INTELLIGENCE (2023)

Article Computer Science, Artificial Intelligence

RORNet: Partial-to-Partial Registration Network With Reliable Overlapping Representations

Yue Wu, Yue Zhang, Wenping Ma, Maoguo Gong, Xiaolong Fan, Mingyang Zhang, A. K. Qin, Qiguang Miao

Summary: Three-dimensional point cloud registration is a significant area in computer vision. To address the challenges posed by complex scenes and incomplete observations, we propose a partial-to-partial registration network (RORNet) that extracts reliable overlapping representations from partially overlapping point clouds and uses them for registration. Our experimental results show that our method outperforms other partial registration methods.

IEEE TRANSACTIONS ON NEURAL NETWORKS AND LEARNING SYSTEMS (2023)

No Data Available