Waste not: Using diverse neural networks from hyperparameter search for improved malware detection

摘要

Many commercial anti-virus software already use some form of machine learning to help with detection. However, there has been little research on ways in which multiple algorithms can be combined to improve malware detection. This paper presents an analysis of a dataset of malware and benign software, analysed by diverse recurrent neural networks (RNNs). Our focus is on analysing the possible benefits and/or drawbacks in malware detection from using multiple algorithms in diverse configurations. We have analysed the sensitivity, specificity and accuracy of RNN combinations with up to 10 models per combination, using prediction results from a previous research. Our results show significant gains in malware detection when using combinations with 1-out-of-N adjudication schemes (an increase of 0.28), and likewise gains for specificity in N-out-of-N schemes (an increase of 0.14). We also look at the interplay between sensitivity and specificity when putting together systems that use a simple majority adjudication scheme (e.g. 3-out-of-5). Additionally, we highlight the major sources of diversity between the various RNN models used, and speculate on the benefits towards specific types of malware. To the best of our knowledge, similar results on the use of diverse machine learning algorithms for malware detection have not been presented in the past.