Machine learning in malware traffic classifications

Previous work on machine learning for intrusion detection in mobile tactical networks using the extremely lightweight intrusion detection (ELIDe) system has shown that ELIDe can approximate signature-based intrusion detection using significantly less resources and power than the traditional intrusion detection system without significantly degrading accuracy. ELIDe also performs binary classification and multiclass classification on various malware that Snort cannot detect. In this paper, we demonstrate how ELIDe identifies malware within network traffic based on partially trained malware signature patterns that have significant weighted values within the classifier's weight vector. Our experiments trained ELIDe with malware signatures and network traffic without the presence of malicious traffic, and we were able to obtain the common partial patterns between the two different data sets. Based on knowledge of the common partial patterns that exist between true-negative and true-positive results from our experiments, we show that ELIDe can improve its false-positive rate without significantly affecting its false-negative rates.