Malware Family Discovery Using Reversible Jump MCMC Sampling of Regimes

References

• Anderson, B., Lane, T., and Hash, C. (2014), “Malware Phylogenetics Based on the Multiview Graphical Lasso,” in Advances in Intelligent Data Analysis XIII, eds. H. Blockeel, M. van Leeuwen, and V. Vinciotti, Vol. 8819 of Lecture Notes in Computer Science, Cham: Springer International Publishing, pp. 1–12.
   Google Scholar
• Beal, M. J., Ghahramani, Z., and Rasmussen, C. E. (2002), “The Infinite Hidden Markov Model,” in Neural Information Processing Systems 14, eds. T. G. Dietterich, S. Becker, and Z. Ghahramani, Cambridge, MA: MIT Press, pp. 577–585.
   Google Scholar
• Bolton, A., and Heard, N. (2014), “Application of a Linear Time Method for Change Point Detection to the Classification of Software,” in Proceedings of the IEEE Joint Intelligence and Security Informatics Conference (JISIC), The Hague: IEEE, pp. 292–295.
   Google Scholar
• Brooks, S. P., and Gelman, A. (1998), “General Methods for Monitoring Convergence of Iterative Simulations,” Journal of Computational and Graphical Statistics, 7, 434–455.
   Web of Science ®Google Scholar
• Chib, S. (1996), “Calculating Posterior Distributions and Modal Estimates in Markov Mixture Models,” Journal of Econometrics, 75, 79–97.
   Web of Science ®Google Scholar
• Contagio (2013), “Mandiant APT1 Samples Categorized by Malware Families,” available at: http://contagiodump.blogspot.co.uk/2013/03/mandiant-apt1-samples-categorized-by.html.
   Google Scholar
• Dai, J., Guha, R., and Lee, J. (2009), “Efficient Virus Detection Using Dynamic Instruction Sequences,” Journal of Computers, 4, 405–414.
   Google Scholar
• Denison, D. G. T., Holmes, C. C., Mallick, B. K., and Smith, A. F. M. (2002), Bayesian Methods for Nonlinear Classification and Regression, Wiley Series in Probability and Statistics, Chichester: Wiley.
   Google Scholar
• Domingos, P., and Provost, F. (2000), “Well-Trained PETs: Improving Probability Estimation Trees,” CDER Working Paper 00-04-IS, Stern School of Business.
   Google Scholar
• Fisher, R. A. (1929), Statistical Methods for Research Workers, Edinburgh: Oliver & Boyd.
   Google Scholar
• Fitzpatrick, M., and Marchev, D. (2013), “Efficient Bayesian Estimation of the Multivariate Double Chain Markov Model,” Statistics and Computing, 23, 467–480.
   Web of Science ®Google Scholar
• Goldfeld, S. M., and Quandt, R. E. (1973), “A Markov Model for Switching Regressions,” Journal of Econometrics, 1, 3–15.
   Google Scholar
• Green, P. J. (1995), “Reversible Jump Markov Chain Monte Carlo Computation and Bayesian Model Determination,” Biometrika, 82, 711–732.
   Web of Science ®Google Scholar
• Han, D., and Tsung, F. (2009), “The Optimal Stopping Time for Detecting Changes in Discrete Time Markov Processes,” Sequential Analysis, 28, 115–135.
   Google Scholar
• Kass, R. E., Carlin, B. P., Gelman, A., and Neal, R. M. (1998), “Markov Chain Monte Carlo in Practice: A Roundtable Discussion,” The American Statistician, 52, 93–100.
   Web of Science ®Google Scholar
• Killick, R., Fearnhead, P., and Eckley, I. A. (2012), “Optimal Detection of Changepoints with a Linear Computational Cost,” Journal of the American Statistical Association, 107, 1590–1598.
   Web of Science ®Google Scholar
• McAfee (2017), “McAfee Labs Threats Report June 2017,” available at: https://www.mcafee.com/us/resources/reports/rp-quarterly-threats-jun-2017.pdf.
   Google Scholar
• Page, E. S. (1954), “Continuous Inspection Schemes,” Biometrika, 41, 100–115.
   Web of Science ®Google Scholar
• Polansky, A. M. (2007), “Detecting Change-Points in Markov Chains,” Computational Statistics and Data Analysis, 51, 6013–6026.
   Web of Science ®Google Scholar
• Royal, P., Halpin, M., Dagon, D., Edmonds, R., and Lee, W. (2006), “PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware,” in Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC ’06), Miami, FL: IEEE, pp. 289–300.
   Google Scholar
• Storlie, C., Anderson, B., Vander Wiel, S., Quist, D., Hash, C., and Brown, N. (2014), “Stochastic Identification of Malware with Dynamic Traces,” The Annals of Applied Statistics, 8, 1–18.
   Web of Science ®Google Scholar
• Tartakovsky, A. G., Rozovskii, B. L., Blažek, R. B., and Kim, H. (2006), “Detection of Intrusions in Information Systems by Sequential Change-Point Methods,” Statistical Methodology, 3, 252–293.
   Google Scholar
• Van Gael, J., Saatci, Y., Teh, Y. W., and Ghahramani, Z. (2008), “Beam Sampling for the Infinite Hidden Markov Model,” in Proceedings of the 25th International Conference on Machine Learning (ICML ’08), New York: ACM, pp. 1088–1095.
   Google Scholar
• Vasas, K., Elek, P., and Márkus, L. (2007), “A Two-State Regime Switching Autoregressive Model with an Application to River Flow Analysis,” Journal of Statistical Planning and Inference, 137, 3113–3126, Special Issue: Bayesian Inference for Stochastic Processes.
   Web of Science ®Google Scholar
• Xian, J.-G., Han, D., and Yu, J.-Q. (2016), “Online Change Detection of Markov Chains With Unknown Post-Change Transition Probabilities,” Communications in Statistics—Theory and Methods, 45, 597–611.
   Web of Science ®Google Scholar
• Xing, H., Sun, N., and Chen, Y. (2012), “Credit Rating Dynamics in the Presence of Unknown Structural Breaks,” Journal of Banking and Finance, 36, 78–89.
   Web of Science ®Google Scholar
• Yakir, B. (1994), “Optimal Detection of a Change in Distribution When the Observations Form a Markov Chain with a Finite State Space,” Lecture Notes – Monograph Series, 23, 346–358.
   Google Scholar
• Zhao, H., and Marriott, P. (2014), “Variational Bayes for Regime-Switching Log-Normal Models,” Entropy, 16, 3832.
   Web of Science ®Google Scholar