Adjusting SVMs for Large Data Sets using Balanced Decision Trees

While machine learning techniques were successfully used for malware identification, they were not without challenges. Over the years, several key points related to the usage of such algorithm for practical applications have evolved: low (close to 0) number of false positives, fast evaluation method, reasonable memory and disk footprint. Because of these constraints, security vendors had to chose a simple algorithm (that can meet all of the above requirements) instead of a more complex ones, even if the later had better detection rates. The present paper describes a hybrid approach that can be used in conjunction with an SVM classifier allowing us to overcome some of the above mentioned constraints.