Unknown malcode detection using classifiers with optimal training sets

1. A method for detecting unknown malicious code in a computer readable file, comprising:

a) creating a Data Set being a collection of files that includes a first subset with malicious code files and a second subset with benign code files;

b) identifying malicious code files and benign code files by an antivirus program;

c) parsing all files using n-gram moving windows of several lengths;

d) for each n-gram in each file, computing a term frequency (TF) representation, wherein the TF representation of an n-gram is the frequency of this n-gram in one of the files;

e) selecting an initial set of top features of all n-grams, based on a document frequency (DF) measure, wherein the DF measure indicates those of the files containing a given n-gram;

f) reducing the number of the top features to comply with the computation resources required for classifier training, by using features selection methods, wherein the features selection methods are DF measure, Gain Ratio and Fisher Score;

g) determining an optimal number of features based on the evaluation of the detection accuracy of several sets of reduced top features;

h) preparing different data sets with different distributions of benign code files and malicious code files, based on said optimal number, which will be used as training and test sets, wherein a percentage of malicious code files in each data set is in a range between 10% and 40% of all the files in the said data set;

i) for each classifier:

i.1) iteratively evaluating the detection accuracy for all combinations of training and test sets distributions, while in each iteration training a classifier using a specific distribution and testing the trained classifier on all distributions; and

i.2) selecting the optimal distribution that results with the highest detection accuracy.

2. A method according to claim 1 , wherein the malicious code is a malicious executable.