An ensemble learning system to mitigate malware concept drift attacks (short paper)

Abstract

Machine learning is widely used in malware detection systems as a core component. However, machine learning algorithm is based on the assumption that the underlying malware concept is stable for training and testing. The assumption is vulnerable to well-crafted concept drift attacks, such as mimicry attacks, gradient descent attacks, poisoning attacks and so on. This paper proposes an ensemble learning system which combines vertical and horizontal correlation learning models. The significant diversity among vertical and horizontal correlation models increases the difficulty of concept drift attacks. And average p-value assessment is applied to fortify the system to be sensitive to hidden concept drift. The experiment results show that the hybrid system could actively recognize the concept drift among different Miuref variants.