Malware Data Science: Attack Detection and Attribution by Joshua Saxe & Hillary Sanders

Author:Joshua Saxe & Hillary Sanders
Language: eng
Format: epub, mobi, azw3, pdf
Publisher: No Starch Press, Inc.
Published: 2018-11-29T16:00:00+00:00

Figure 7-2: Suspiciousness scores output by the hypothetical MalDetect system for individual software binaries

Suspiciousness scores are informative, but in order to calculate MalDetect’s true positive rate and false positive rate on our files, we need to convert MalDetect’s suspiciousness scores to “yes” or “no” answers regarding whether or not a given software binary is malicious. To do this, we use a threshold rule. For example, we decide that if the suspiciousness score is greater or equal to some number, the binary in question raises a malware alarm. If the score is lower than the threshold, it doesn’t.

Such a threshold rule is the standard way to convert a suspiciousness score into a binary detection choice, but where should we set the threshold? The problem is that there is no right answer. Figure 7-3 shows the conundrum: the higher we set the threshold, the less likely we are to get false positives, but the more likely we are to get false negatives.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.