A Dempster–Shafer, Fusion-Based Approach for Malware Detection

Patricio Galdames (), Simon Yusuf Enoch, Claudio Gutiérrez-Soto and Marco A. Palomino ()
Additional contact information
Patricio Galdames: Facultad de Ingeniería, Universidad San Sebastián, Concepción 4080871, Chile
Simon Yusuf Enoch: Technology & Innovation, School of Information Technology, Whitecliffe, Wellington 6011, New Zealand
Claudio Gutiérrez-Soto: Departamento de Sistemas de Información, Universidad del Bío-Bío, Concepción 4081112, Chile
Marco A. Palomino: School of Natural and Computing Sciences, University of Aberdeen, Aberdeen AB24 3FX, UK

Mathematics, 2025, vol. 13, issue 16, 1-22

Abstract: Dempster–Shafer theory (DST), a generalization of probability theory, is well suited for managing uncertainty and integrating information from diverse sources. In recent years, DST has gained attention in cybersecurity research. However, despite the growing interest, there is still a lack of systematic comparisons of DST implementation strategies for malware detection. In this paper, we present a comprehensive evaluation of DST-based ensemble mechanisms for malware detection, addressing critical methodological questions regarding optimal mass function construction and combination rules. Our systematic analysis was tested with 630,504 benign and malicious samples collected from four public datasets (BODMAS, DREBIN, AndroZoo, and BMPD) to train malware detection models. We explored three approaches for converting classifier outputs into probability mass functions: global confidence using fixed values derived from performance metrics, class-specific confidence with separate values for each class, and computationally optimized confidence values. The results establish that all approaches yield comparable performance, although fixed values offer significant computational and interpretability advantages. Additionally, we introduced a novel linear combination rule for evidence fusion, which delivers results on par with conventional DST rules while enhancing interpretability. Our experiments show consistently low false positive rates—ranging from 0.16% to 3.19%. This comprehensive study provides the first systematic methodology comparison for DST-based malware detection, establishing evidence-based guidelines for practitioners on optimal implementation strategies.

Keywords: malware detection; Dempster–Shafer theory; ensemble learning; classifier fusion; machine learning; uncertainty quantification (search for similar items in EconPapers)
JEL-codes: C (search for similar items in EconPapers)
Date: 2025
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/2227-7390/13/16/2677/pdf (application/pdf)
https://www.mdpi.com/2227-7390/13/16/2677/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jmathe:v:13:y:2025:i:16:p:2677-:d:1728475

Access Statistics for this article

Mathematics is currently edited by Ms. Emma He

More articles in Mathematics from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().