Malicious apps use various methods to spread viruses, take control of computers and/or IoT devices, and steal sensitive data such as credit card numbers or other personal information. Despite the numerous existing means of intrusion detection, malware code is not easily detectable. The primary issue with current malware detection approaches is their inability to identify novel attacks and obfuscated malware, as they rely on static bases of malware examples, making them susceptible to new unseen malware behaviors. To address this, we propose a new method for malware recognition, which consists of two processes: the first process creates new instances of malware using a memetic algorithm, and the second process detects these new instances of attacks through solid detectors produced by an artificial immune system-based algorithm. Our new malware recognition method has proven its merits through thorough experiments on widely used datasets and evaluation metrics, and has been compared to prominent state-of-the-art methods.

To offer innovative malware evolution techniques, it is appealing to integrate approaches that handle imperfect data and knowledge.In fact, malware writers tend to target some precise features within the app's code to camouflage the malicious content.Those features may sometimes present conflictual information about the true nature of the content of the app (malicious/benign).In this paper, we show how the Variable Precision Rough Set (VPRS) model can be combined with optimization techniques, in particular Bilevel-Optimization-Problems (BLOPs), in order to establish a detection model capable of following the crazy race of malware evolution initiated among malware-developers.We propose a new malware detection technique, based on such hybridization, named Variable Precision Rough set Malware Detection (ProRSDet), that offers robust detection rules capable of revealing the new nature of a given app.ProRSDet attains encouraging results when tested against various state-of-the-art malware detection systems using common evaluation metrics.