A New Method for Malware Classification Using Hyperspheres

The rapid increase in scale and complexity of malware attacks has made traditional signature-based defense approaches less effective due to the inability to detect new forms of malware. Therefore, there is a need for more advanced malware classification methods, which can identify both known and unknown malware efficiently enough, without using signatures. In this paper, we propose a new machine-learning technique for open-world malware classification, using hyperspheres for the succinct representation of different malware families. For each malware sample that needs to be classified, we calculate the probability for it to belong to each hypersphere, then assign the sample to the family having the hypersphere with the highest probability of containing the sample point. Results from experiments have demonstrated the effectiveness of our proposed method on malware datasets for personal computers.

I. Introduction

As the Internet continues to grow, so too has the number and diversity of malware. Currently, many anti-malware programs rely on signature-based techniques to determine if a piece of software is malicious or safe. However, this method has a major drawback in that it cannot identify novel, previously unseen malware. In recent years, machine learning has made significant advancements and has been applied in various fields, including information security. There has been a rise in the number of studies published on using machine learning for malware detection and classification, with promising results. Our study aims to explore and suggest an open-world approach for classifying malware using machine learning.