Fractal based adaptive boosting algorithm for cognitive detection of computer malware

Abstract

Host Based Intrusion Detection Systems (HIDS) are gaining traction in discovering malicious software inside a host operating system. In this paper, the authors have developed a new cognitive host based anomaly detection system based on supervised AdaBoost machine learning algorithm. Particularly, information fractal dimension based approach is incorporated in the original AdaBoost machine learning algorithm to assign higher weight to the classifier that estimates wrong hypothesis. An agent based host sensor is developed that continuously gathers and extracts network profile of all the host processes and the modules spawned by each process of a Microsoft Windows 7 operating system. The main contributions of this paper are that a malware testing sandbox is developed using Microsoft native APIs and an information fractal (cognitive) based AdaBoost algorithm is designed and developed. Our results on empirical data set shows that the malware detection performance of the proposed algorithm outperforms original AdaBoost algorithm in detecting positives including the reduction of false negatives.