LockBoost: Detecting Malware Binaries by Locking False Alarms

High-stake applications, such as malware detection, demand a high true-positive rate (TPR) while meeting a firm (usually very low) false-positive rate (FPR, i.e., false alarms). This goal is hard to achieve using classic cost-sensitive learning, which requires a cost ratio that is difficult to specify in practice. Also, selecting a threshold point on the receiver operating characteristic (ROC) curve to meet a specified low FPR often leads to a poor TPR, as TPR and FPR adversely affect one another. To address the above requirement, we propose a novel approach called “LockBoost” that locks FPR at a specified level while iteratively boosting TPR during the training process. LockBoost produces a sequence of classifiers where each next classifier “picks up” the true positives missed due to the enforcement of the low FPR by the previous classifier. We adapt LockBoost to detect malware binaries in four datasets, including two recently released public benchmarks, SOREL and BODMAS. With FPR locked at the target level of 0.1% or lower, we achieve ≈9% and ≈7% TPR improvement over state-of-the-art methods on sequential and tabular features, respectively.