针对安卓恶意软件检测中的数据不平衡问题，提出动态分类器选择方法。
Imbalanced malware classification: an approach based on dynamic classifier selection
- 为每个分类器独立设计平衡策略，提升整体性能
- KNOP算法结合随机森林在测试集上表现最佳
- 平衡处理显著降低少数类识别难度，适合安全检测场景
近年来，网络威胁的增加凸显了强大恶意软件检测系统的重要性，尤其是在移动设备上。恶意软件利用设备和用户数据中的漏洞，构成重大安全风险。恶意软件检测面临的主要挑战是数据集不平衡：大多数应用为良性，仅少数具有威胁性。本研究针对这一常被忽视的问题，评估了多种机器学习策略在检测安卓应用恶意软件中的表现。比较了单一分类器与集成方法，重点关注动态选择算法，其性能优于传统方法。不同于对整个数据集进行平衡的策略，本文提出针对分类器池中每个分类器分别实施平衡过程。实证分析表明，使用随机森林作为分类器池时，KNOP算法表现最佳。实例难度评估显示，平衡处理降低了少数类的识别难度，提升了恶意软件检测能力。实验代码已公开于 https://github.com/jvss2/Machine-Learning-Empirical-Evaluation。
原文摘要 · Abstract (English)
In recent years, the rise of cyber threats has emphasized the need for robust malware detection systems, especially on mobile devices. Malware, which targets vulnerabilities in devices and user data, represents a substantial security risk. A significant challenge in malware detection is the imbalance in datasets, where most applications are benign, with only a small fraction posing a threat. This study addresses the often-overlooked issue of class imbalance in malware detection by evaluating various machine learning strategies for detecting malware in Android applications. We assess monolithic classifiers and ensemble methods, focusing on dynamic selection algorithms, which have shown superior performance compared to traditional approaches. In contrast to balancing strategies performed on the whole dataset, we propose a balancing procedure that works individually for each classifier in the pool. Our empirical analysis demonstrates that the KNOP algorithm obtained the best results using a pool of Random Forest. Additionally, an instance hardness assessment revealed that balancing reduces the difficulty of the minority class and enhances the detection of the minority class (malware). The code used for the experiments is available at https://github.com/jvss2/Machine-Learning-Empirical-Evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。