Single Property Feature Selection applied to Malware Detection

The feature selection step - the ability for a model to extract good features - is the most important aspect of any model, as if some features that are part of the set which defines the concept class are excluded, no machine learning algorithm can capture and truly learn the concept class of interest. It has been the norm that the feature selection step is carried out on groups of properties, called attributes. In this work, we propose a new method for feature selection based on Information Gain, that allows for selection of attributes without assuming independence between them and by assigning ranks to properties instead of the whole attribute. This approach can be used with single class learning given that the probability distribution of the features is known. We tested this approach against Mutual Information and TFIDF, using a model based on conceptual space theory. Despite the mostly biased model, a slight increase in the accuracy of classification has been obtained compared to the other feature selection methods. Based on the dataset used, we found out that the absence of certain instructions such as jmp, could be used to detect Trojans with weak association. We anticipate that the proposed approach can be used in future work to allow a model to construct its own dimensions freely from sequences of opcodes.