A Bayesian Model Combination-based approach to Active Malware Analysis

TL;DR

This paper introduces a Bayesian Model Combination approach to improve the efficiency and performance of Active Malware Analysis by modeling it as a Bayes-Active Markov Decision Process.

Contribution

It presents a novel Bayesian Model Combination method for training malware analyzers, enhancing decision-making in active malware analysis tasks.

Findings

Improved performance over existing Bayesian methods

More efficient action selection in malware analysis

Effective modeling of malware behavior through Bayesian approaches

Abstract

Active Malware Analysis involves modeling malware behavior by executing actions to trigger responses and explore multiple execution paths. One of the aims is making the action selection more efficient. This paper treats Active Malware Analysis as a Bayes-Active Markov Decision Process and uses a Bayesian Model Combination approach to train an analyzer agent. We show an improvement in performance against other Bayesian and stochastic approaches to Active Malware Analysis.