Zero-Day Malware Detection and Effective Malware Analysis Using Shapley Ensemble Boosting and Bagging Approach.

Area of Science:

• Cybersecurity
• Machine Learning
• Software Vulnerability Analysis

Background:

• Software vulnerabilities are a significant security concern, frequently exploited by malware.
• Machine learning (ML) offers state-of-the-art capabilities for malware detection.
• Improving ML model accuracy by minimizing false negatives and false positives is crucial.

Purpose of the Study:

• To enhance the performance of bagging and boosting ML models in malware detection.
• To utilize Shapley values for feature contribution analysis and misclassification reduction.
• To develop effective inductive rules for improved cybersecurity by analyzing feature trends in misclassified instances.

Main Methods:

• Evaluated bagging and boosting ML models on three distinct malware datasets.
• Employed Shapley values to identify and analyze feature contributions for ML predictions.
• Transformed Shapley values to a probability scale for correlation with ML predictions.
• Generated inductive rules using waterfall plots based on feature probability scales.

Main Results:

• Determined the best-performing ML model (bagging or boosting) based on accuracy and confusion matrix analysis.
• Successfully identified top features contributing to ML model predictions using Shapley values.
• Demonstrated the utility of feature trends from misclassifications in creating inductive rules.
• Enhanced the detection of false-negative zero-day malware.

Conclusions:

• The proposed method effectively reduces misclassifications in ML-based malware detection.
• Shapley value analysis provides insights into feature importance for cybersecurity applications.
• Inductive rules derived from feature trends improve the identification of novel and evasive malware.
• This research contributes to more robust cybersecurity defenses against evolving threats.