A Decision Making Model for Collaborative Malware Detection Networks

The increased sophistication and evasiveness of malware has brought tremendous challenges to vendors of antivirus systems. Various malware detection approaches have been proposed and deployed to detect and remove malware. However, it is challenging for a single security vendor to analyze all malware and to provide up-to-date protection, e.g., a signature database. In this paper, we investigate the effectiveness of collaboration amongst various antivirus systems and propose a distributed collaborative malware detection network (CMDN). We design a novel collaborative malware detection decision model, RevMatch, where collaborative malware detection decisions are made based on the scanning history with multiple antivirus systems. We evaluate our system on realworld malware data sets and show that collaborative malware detection techniques can improve detection accuracy significantly. Furthermore, RevMatch outperforms existing decision models in terms of detection quality, runtime efficiency, and robustness against insider attacks.