Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 295

probability distribution which is updated based on the environment responses to the
action taken by the automaton. Given a finite number of actions that can be performed
in a random environment, when a specific action is taken place the environment
provides a random response which is either favorable or unfavorable. The objective in
the design of the automaton is to determine how the choice of the action at any stage
should be guided by past actions and responses [21].
The PSO is first introduced by Kennedy and Eberhart [10]. In PSO, a potential
solution for a problem is considered as a bird, which is called a particle, flies through
a D-dimensional space and adjusts its position according to its own experience and
other particles'. In PSO, a particle is represented by its position vector x and its
velocity vector v .
The great deluge algorithm (GD) is first introduced by Dueck [5], but unfortunately
was not widely useful in succeeding years. This local search meta-heuristic is different
from its predecessors (e.g. Hill-Climbing or Simulated Annealing) in the acceptance of
a candidate solution from a neighborhood. The GD algorithm accepts all solutions, for
which absolute values of the cost function are less than or equal to the current boundary
value, called “level”. The local search starts with the initial value of “level” equal to an
initial cost function and during the search its value is monotonically reduced. A
decrement of the reduction (defined by the user) appears as a single algorithmic
parameter.

3 Proposed Combination Framework of PSO, LA and GD
Algorithms

To get rid of the premature convergence of PSO algorithm, it is needed to use a
mechanism that produces perturbation in population. A very promising method is to
turn to multi-swarm mechanisms. In the multi-swarm mechanism, there must be a
parent swarm which is responsible for finding promising area in the search space and
also some child swarms which are created to exploit the new found promising area
[1-3] and [10].
This paper differently deals with the premature problem. It uses a PSO in which
each particle uses a learning automaton based on which the particle decides how to
update its velocity. Indeed each automaton learns how to behave in predefined
situations. These situations contain variance of the best fitness of local optima and the
distance of the particle to its local and global optima. The learning of the automaton is
based on feedbacks received from the environment. A feedback per each particle is
set according to its current position's fitness and the previous position's fitness. It
means that if the previous position's fitness is higher than the current position's, the
action taken on the previous position to reach the current position is punishes else it is
rewarded.
In the proposed method, the states of learning automaton A j is a triple denoted by
( var,dis j 1 ,dis j 2 ), where var, dis j 1 and dis j 2 are three quantitative variables belong to
{0,1,2}. To calculate var first maximum distance between two arbitrary selected X i l
( i

∈ 1..N ) is defined as max_disqp .