A novel node splitting criteria for decision trees based on Theil index

Abstract

The performance of detectors using decision trees can be improved by reducing the average height of the tree for faster detection. We propose a new attribute splitting criteria for decision tree construction using the concept of Theil index. The Theil index is a statistic used to measure economic inequality. Results show a decrease in average height compared to the frequently used trees like ID3 and C4.5 using impurity measure as the splitting criterion. Detection of malware using data mining techniques has been explored extensively. Techniques used for detecting malware based on structural features rely on being able to identify anomalies in the structure of executable files. These features might indicate that the file was created or infected to perform malicious activity. They are applied to a decision tree using Theil index as splitting criterion for classification as malware or benign files. © 2012 Springer-Verlag.