{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,8]],"date-time":"2026-09-08T22:53:20Z","timestamp":1788908000533,"version":"build-2803163510"},"reference-count":27,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2022,4,6]],"date-time":"2022-04-06T00:00:00Z","timestamp":1649203200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Software products from all vendors have vulnerabilities that can cause a security concern. Malware is used as a prime exploitation tool to exploit these vulnerabilities. Machine learning (ML) methods are efficient in detecting malware and are state-of-art. The effectiveness of ML models can be augmented by reducing false negatives and false positives. In this paper, the performance of bagging and boosting machine learning models is enhanced by reducing misclassification. Shapley values of features are a true representation of the amount of contribution of features and help detect top features for any prediction by the ML model. Shapley values are transformed to probability scale to correlate with a prediction value of ML model and to detect top features for any prediction by a trained ML model. The trend of top features derived from false negative and false positive predictions by a trained ML model can be used for making inductive rules. In this work, the best performing ML model in bagging and boosting is determined by the accuracy and confusion matrix on three malware datasets from three different periods. The best performing ML model is used to make effective inductive rules using waterfall plots based on the probability scale of features. This work helps improve cyber security scenarios by effective detection of false-negative zero-day malware.<\/jats:p>","DOI":"10.3390\/s22072798","type":"journal-article","created":{"date-parts":[[2022,4,7]],"date-time":"2022-04-07T21:08:22Z","timestamp":1649365702000},"page":"2798","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":39,"title":["Zero-Day Malware Detection and Effective Malware Analysis Using Shapley Ensemble Boosting and Bagging Approach"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1306-464X","authenticated-orcid":false,"given":"Rajesh","family":"Kumar","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Vellore Institute of Technology, Chennai Campus, Chennai 600127, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Geetha","family":"Subbiah","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Vellore Institute of Technology, Chennai Campus, Chennai 600127, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,4,6]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Pohl, H. (2008). Zero-Day and Less-Than-Zero-Day Vulnerabilities and Exploits. Forschungsspitzen und Spitzenforschung, Physica-Verlag HD.","DOI":"10.1007\/978-3-7908-2127-7_12"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Egelman, S., Herley, C., and van Oorschot, P.C. (2013, January 9\u201312). Markets for zero-day exploits: Ethics and implications. Proceedings of the 2013 New Security Paradigms Workshop, Banff, AB, Canada.","DOI":"10.1145\/2535813.2535818"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1728303","DOI":"10.1155\/2018\/1728303","article-title":"Use of Data Visualisation for Zero-Day Malware Detection","volume":"2018","author":"Venkatraman","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"49418","DOI":"10.1109\/ACCESS.2018.2864871","article-title":"Malytics: A malware detection scheme","volume":"6","author":"Hamey","year":"2018","journal-title":"IEEE Access"},{"key":"ref_5","unstructured":"Kardan, N., and Stanley, K.O. (2016). Fitted Learning: Models with Awareness of their Limits. arXiv."},{"key":"ref_6","unstructured":"Harang, R., and Ducau, F.N. (2018). Measuring the Speed of the Red Queen\u2019s Race, BlackHat."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1109\/MSEC.2018.2875369","article-title":"The Need for Speed: An Analysis of Brazilian Malware Classifers","volume":"16","author":"Ceschin","year":"2019","journal-title":"IEEE Secur. Priv."},{"key":"ref_8","unstructured":"USENIX Association (2005). Transcend: Detecting Concept Drift in Malware Classification Models, USENIX."},{"key":"ref_9","first-page":"72","article-title":"SEEM: A scalable visualization for comparing multiple large sets of attributes for malware analysis","volume":"10","author":"Gove","year":"2014","journal-title":"ACM Int. Conf. Proc. Ser."},{"key":"ref_10","unstructured":"Wagner, M., Fischer, F., Luh, R., Haberson, A., Rind, A., Keim, D.A., and Aigner, W. (2015, January 25\u201329). A Survey of Visualization Systems for Malware Analysis. Proceedings of the Eurographics Conference on Visualization (EuroVis), Cagliari, Italy."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Ye, Z., Guo, Y., and Ju, A. (2019). Zero-Day Vulnerability Risk Assessment and Attack Path Analysis Using Security Metric, Springer International Publishing.","DOI":"10.1007\/978-3-030-24268-8_25"},{"key":"ref_12","unstructured":"Anderson, H.S., and Roth, P. (2018). EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Fleshman, W., Raff, E., Zak, R., McLean, M., and Nicholas, C. (2018, January 22\u201324). Static Malware Detection & Subterfuge: Quantifying the Robustness of Machine Learning and Current Anti-Virus. Proceedings of the 2018 13th International Conference on Malicious and Unwanted Software (MALWARE), Nantucket, MA, USA.","DOI":"10.1109\/MALWARE.2018.8659360"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"536","DOI":"10.25046\/aj050566","article-title":"Malware classification using XGboost-Gradient boosted decision tree","volume":"5","author":"Kumar","year":"2020","journal-title":"Adv. Sci. Technol. Eng. Syst."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s11416-016-0283-1","article-title":"An investigation of byte n-gram features for malware classification","volume":"14","author":"Raff","year":"2018","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Hemalatha, J., Roseline, S.A., Geetha, S., Kadry, S., and Dama\u0161evi\u010dius, R. (2021). An efficient densenet-based deep learning model for Malware detection. Entropy, 23.","DOI":"10.3390\/e23030344"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"367","DOI":"10.1049\/iet-ifs.2018.5268","article-title":"Dynamic API call sequence visualisation for malware classification","volume":"13","author":"Tang","year":"2019","journal-title":"IET Inf. Secur."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Jindal, C., Salls, C., Aghakhani, H., Long, K., Kruegel, C., and Vigna, G. (2019, January 9\u201313). Neurlux: Dynamic malware analysis without feature engineering. Proceedings of the 35th Annual Computer Security Applications Conference, San Juan, PR, USA.","DOI":"10.1145\/3359789.3359835"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Kim, D., Mirsky, D., Majlesi-Kupaei, A., and Barua, R. (2018, January 22\u201324). A Hybrid Static Tool to Increase the Usability and Scalability of Dynamic Detection of Malware. Proceedings of the 2018 13th International Conference on Malicious and Unwanted Software (MALWARE), Nantucket, MA, USA.","DOI":"10.1109\/MALWARE.2018.8659373"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Raff, E., Sylvester, J., and Nicholas, C. (2017, January 3). Learning the PE header, malware detection with minimal domain knowledge. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Dallas, TX, USA.","DOI":"10.1145\/3128572.3140442"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1007\/978-3-642-04342-0_7","article-title":"PE-miner: Mining structural information to detect malicious executables in realtime","volume":"5758","author":"Shafiq","year":"2009","journal-title":"Recent Advances in Intrusion Detection"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1038\/s42256-019-0138-9","article-title":"From local explanations to global understanding with explainable AI for trees","volume":"2","author":"Lundberg","year":"2020","journal-title":"Nat. Mach. Intell."},{"key":"ref_23","unstructured":"Jung, W., and Kim, S. (2015, January 18\u201321). Poster: Deep Learning for Zero-day Flash Malware Detection. Proceedings of the 36th IEEE Symposium on Security and Privacy (S&P), San Jose, CA, USA."},{"key":"ref_24","first-page":"171","article-title":"Zero-day malware detection based on supervised learning algorithms of API call signatures","volume":"121","author":"Alazab","year":"2010","journal-title":"Conf. Res. Pract. Inf. Technol. Ser."},{"key":"ref_25","unstructured":"Shafiq, M.Z., Tabish, S.M., Mirza, F., and Farooq, M. (2015). A Framework for Efficient Mining of Structural Information to Detect Zero-Day Malicious Portable Executables, FAST National University of Computer & Emerging Sciences."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"2211","DOI":"10.1007\/s40747-021-00396-9","article-title":"A robust intelligent zero-day cyber-attack detection technique","volume":"7","author":"Kumar","year":"2021","journal-title":"Complex Intell. Syst."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1016\/j.ins.2018.04.092","article-title":"Zero-day malware detection using transferred generative adversarial networks based on deep autoencoders","volume":"460\u2013461","author":"Kim","year":"2018","journal-title":"Inf. Sci."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/7\/2798\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:48:55Z","timestamp":1760136535000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/7\/2798"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,6]]},"references-count":27,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2022,4]]}},"alternative-id":["s22072798"],"URL":"https:\/\/doi.org\/10.3390\/s22072798","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4,6]]}}}