Class-Wise Information Gain

This chapter proposes a new statistics named class-wise information gain (CIG) and a CIG-based malware detection method to detect malware loaders and infected executables in the Wild. The proposed CIG, extending from the IG, allows people to pay more attention to a specific class and select the features for each class to balance or adjust the proportions of the features in the detecting feature set (DFS) freely. The CIG-based malware detection method involves two modules: feature selection and classification module. The experimental results suggest that the CIG is able to select the features for a specific class e.g., document frequency based CIG (DFCIG)-M, and the proposed CIG-based malware detection method is an effective and universal way to detect both malware loaders and infected executables. The memory requirement of the proposed method is just about 60 percent less than that of the IG-based methods.