Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection

In this paper, we introduce and evaluate PROPEDEUTICA, a novel methodology and framework for efficient and effective real-time malware detection, leveraging the best of conventional machine learning (ML) and deep learning (DL) algorithms. In PROPEDEUTICA, all software processes in the system start execution subjected to a conventional ML detector for fast classification. If a piece of software receives a borderline classification, it is subjected to further analysis via more performance expensive and more accurate DL methods, via our newly proposed DL algorithm DEEPMALWARE. Further, we introduce delays to the execution of software subjected to deep learning analysis as a way to "buy time" for DL analysis and to rate-limit the impact of possible malware in the system. We evaluated PROPEDEUTICA with a set of 9,115 malware samples and 877 commonly used benign software samples from various categories for the Windows OS. Our results show that the false positive rate for conventional ML methods can reach 20%, and for modern DL methods it is usually below 6%. However, the classification time for DL can be 100X longer than conventional ML methods. PROPEDEUTICA improved the detection F1-score from 77.54% (conventional ML method) to 90.25%, and reduced the detection time by 54.86%. Further, the percentage of software subjected to DL analysis was approximately 40% on average. Further, the application of delays in software subjected to ML reduced the detection time by approximately 10%. Finally, we found and discussed a discrepancy between the detection accuracy offline (analysis after all traces are collected) and on-the-fly (analysis in tandem with trace collection). Our insights show that conventional ML and modern DL-based malware detectors in isolation cannot meet the needs of efficient and effective malware detection: high accuracy, low false positive rate, and short classification time.Comment: 17 pages, 7 figure

Detection of Cognitive States from fMRI data using Machine Learning Techniques

Over the past decade functional Magnetic Resonance Imaging (fMRI) has emerged as a powerful technique to locate activity of human brain while engaged in a particular task or cognitive state. We consider the inverse problem of detecting the cognitive state of a human subject based on the fMRI data. We have explored classification techniques such as Gaussian Naive Bayes, k-Nearest Neighbour and Support Vector Machines. In order to reduce the very high dimensional fMRI data, we have used three feature selection strategies. Discriminating features and activity based features were used to select features for the problem of identifying the instantaneous cognitive state given a single fMRI scan and correlation based features were used when fMRI data from a single time interval was given. A case study of visuo-motor sequence learning is presented. The set of cognitive states we are interested in detecting are whether the subject has learnt a sequence, and if the subject is paying attention only towards the position or towards both the color and position of the visual stimuli. We have successfully used correlation based features to detect position-color related cognitive states with 80% accuracy and the cognitive states related to learning with 62.5% accuracy