Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 291

applying the clustering algorithm. As it is obvious, the finding of building blocks is
sub-quadratic either in non-overlapping challenging problems, or in overlapping ones.
It is worthy to note that the time order of the algorithm in the challenging problems
increases as the size of building blocks increases no matter it is overlapping functions.
This is very important result, because as the size of building blocks in the BOA and in
the HBOA, the times orders of these algorithms increase exponentially [8].
(a) (b)
Fig. 2. (a) Number of fitness evaluations vs. problem size for trap5 and trap10. (b) Number of
fitness evaluations vs. problem size for deceptive3 and deceptive7.
Fig. 3. Number of fitness evaluations vs. problem size one-bit overlap trap5 and trap10
5 Conclusions
With the purpose of learning the linkages in the complex problem a novel approach is
proposed. There are other approaches that are claimed to be able to solve those
challenging problems in tractable polynomial time. But the proposed approach does
not classified into the existence categories. This work has looked at the problem from
whole different points of view. Our method is based on some properties of additively
decomposable problems in order to identify the linkage groups. The amazing property