AOAFS: A Malware Detection System Using an Improved Arithmetic Optimization Algorithm

Abstract

Malware detection datasets often contain a huge number of features, many of which are irrelevant, noisy, and duplicated. This issue diminishes the efficacy of Machine Learning models used for malware detection. Feature Selection (FS) is an approach commonly used to reduce the number of features in a malware detection dataset to a smaller set of features to facilitate the ease of the Machine Learning process. The Arithmetic Optimization Algorithm (AOA) is a relatively new efficient optimization algorithm that can be used for FS. This work introduces a new malware detection system called the improved AOA method for FS (AOAFS) that enhances the performance of Machine Learning techniques for malware detection. The AOAFS contains three key enhancements. First, the K-means clustering method is used to improve the initial population of the AOAFS. Second, sixteen Binary Transfer Functions are applied to model the binary solution space for FS in the AOAFS. Finally, Dynamic Opposition-based Learning is utilized to improve the mutation capability of the AOAFS. Several malware datasets were used to compare the AOAFS to four popular Machine Learning algorithms and eight famous wrapper-based optimization algorithms. Statistically, the AOAFS was evaluated using the Friedman Test for ranking the tested algorithms, while the Wilcoxon Signed-Rank Test was employed for pairwise comparisons. The results indicated that the AOAFS achieves the highest classification accuracy with the smallest feature set across all datasets.

Keywords

• malware detection
• arithmetic optimization algorithm
• feature selection
• k-means clustering
• dynamic opposition-based learning