Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 290

LOLL algorithm is again called for three sub-problems in XsArray . The algorithm
could be simplified but it is developed in a general form so that it can also identify the
overlapping linkage groups. The experimental results regarding overlapping linkage
groups and complexity analysis of them are kept to be reported in our future work.
X s Q
U
DiscoveredBBs=LOL(X s )
Search Phase:
S.1. Run DHC s ;
S.2. Save local solutions to HighModals set.
S.3. If p--exit--search < (sp) goto Analysis phase.
Else goto S.1.
Analysis Phase:
A.1. Perform XOR between each two members of HighModals set.
Put the XORed into XORed set.
A.2. Find the strings with least number of 1s in XORed set.
Set its number of 1s = r as length of BB, and put those XORed members
to set DiscoveredBBs.
A.3. Delete those XORed members which their length is equal to length X s .
A.4. Put all the indexes of bits of each member of XORed set which its length
is equal to r into a set DeterminedBits.
A.5. For each member of XORed set i,
If((length(i)>r)^all of the bits of i which are not in DeterminedBits)
Put that in the set XsArray;
A.6. Put the (X s -(indexes of all the bits which value 1 in the XORed set)) into
XsArray;
A.7. If all of the variables of the problem ∈ DeterminedBits
\*all of the variables are assigned to linkage group (at least) *\
Terminates the algorithm.
Else
for i=1 to length XsArray Do
DiscoveredBBs=LOL(XsArray[i]);
Fig. 1. Local Optimum based Linkage Learning Algorithm
If we have two or more optimums in each building block, the method has some
drawbacks in finding the final DiscoveredBBs . For handling this drawback we use
each of these DiscoveredBBs as one cluster. Then cluster ensemble problem can be
solved by cutting a minimal number of clusters (hyperedges) using approach the
HyperGraph-Partitioning Algorithm (HGPA) [9].
4 Empirical Results
For all tested problems, 30 independent runs are performed and our approach is
required to find all the linkage groups accurately in all the 30 runs. The performance
of LOLL is measured by the average number of fitness evaluations until it terminates.
The results are summarized in the Fig 2-3. All this results are obtained without