\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Review of Contemporary Literature on Machine Learning based Malware Analysis and Detection Strategies},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2016-01-15 (revised: 15 January 2016)}
\def\TheID{\makeatother }
\def\TheDate{2016-01-15}
\title{Review of Contemporary Literature on Machine Learning based Malware Analysis and Detection Strategies}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{G. Bala  Krishna}

             \author[2]{V.  Radha}

             \author[3]{K. Venugopala  Rao}

             \affil[1]{  KMIT/JNTUH}

\renewcommand\Authands{ and }

\date{\small \em Received: 12 December 2015 Accepted: 4 January 2016 Published: 15 January 2016}

\maketitle


\begin{abstract}
        


Abstract: malicious software also known as malware are the critical security threat experienced by the current ear of internet and computer system users. The malwares can morph to access or control the system level operations in multiple dimensions. The traditional malware detection strategies detects by signatures, which are not capable to notify the unknown malwares. The machine learning models learns from the behavioral patterns of the existing malwares and attempts to notify the malwares with similar behavioral patterns, hence these strategies often succeeds to notify even about unknown malwares. This manuscript explored the detailed review of machine learning based malware detection strategies found in contemporary literature.  

\end{abstract}


\keywords{malware detection, malware signature, API call sequence, anomalies, static analysis, dynamic analysis, machine learning.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{I. introduction}]{I. introduction}\par
he term "Malware" stands for malicious software, and it usually specifies as hostile software application. According to G. Mc Graw et al., \hyperref[b0]{[1]} there are multiple causes as code added, changed, or removed from the software it get corrupt and it deliberately causes harm and disrupt normal computing activity. A virus had a broad range of destructive software applications such as viruses, Trojans, Spywares and other intrusive code \hyperref[b1]{[2]}.\par
The malware can discriminate by the capability of replication, propagation, self-execution and corruption of the operating system. If the computer system gets extortion it influence on confidential information, integrity and denial of assistance. In malware Replication is a crucial component as it assure its existence.\par
In some cases Replication generates consumption and continuation of system resources (e. g. hard disk, RAM). If confidential assets are being used by any other malware types other than the user, to conceal themselves from anti-malware detector they use a technique called polymorphic or metamorphic techniques.\par
The operating system gets corrupt through data transfer from desecrate device to another protected device familiar, such as executable files, boot records of disk drives or exhausting network bandwidth, by using local or network files system. In such case malware makes operating system susceptibility and few software bugs are faults and it starts its life cycle at the same system and infected system simultaneously by remotely control.\par
According to a McAfee simplified report (year 2013) says that "malware continues to grow" \hyperref[b2]{[3]} and by G Data and king \hyperref[b3]{[4]}  \hyperref[b4]{[5]} soft Laboratory declare nnumber of innovative malware will emerge promptly and to build an anti-malware the analyzers and constructors are enhanced by their unique techniques and methods \hyperref[b5]{[6]}- \hyperref[b9]{[10]}. To construct a malicious software the techniques which are been used to categorized and estimate in groups such as obfuscation techniques, invocation methods, platform, spreading and propagation techniques.\par
To actuate a program has a malicious attentive or not, malware detection system is used. In this detection system there are two different functions, detection and analysis \hyperref[b11]{[12]}. Detection system is a protecting one as it may or may not be prevail in the same system \hyperref[b12]{[13]} and the tasks can be split into client and server as it analogous in cloud-based antivirus \hyperref[b7]{[8,}\hyperref[b11]{12]}. A numerous renovations are made on detection and analysis functions \hyperref[b4]{[5]}, \hyperref[b11]{[12]}, \hyperref[b14]{[15]}- \hyperref[b18]{[19]}.\par
In malware detection system specialized solutions are added to expansion in success and achievement. Such as cloud computing \hyperref[b9]{[10]}, network based detection system [20], web, virtual machine \hyperref[b20]{[21]}, \hyperref[b21]{[22]}, agent technology \hyperref[b22]{[23]}- \hyperref[b28]{[29]} or by the use of hybrid methods and technologies. 
\section[{II.}]{II.} 
\section[{Review of Contemporary Literature and Contributions}]{Review of Contemporary Literature and Contributions}\par
In earlier stage malware had come up with signature based detection. But now in this stage malware signature has introduced an automatic generation and it is pretended to be important and it increased its pattern in similar speed.\par
The signature based detection system has some imperfection as follows to continue the updates of T signature it requires high maintenance cost. By inclusion such methods it could be evenly avoided by malware in polymorphic form \hyperref[b29]{[30]}. To conquer the imperfection, it embraces code in normal vision to grab the consecrate original maliciousness. To vary the polymorphic techniques and apply, this grabbed malicious code is used but still it is anemic to detecting obfuscated malware. Apart from this some execution paths can be explored execution  {\ref [31] [30]}.\par
Due to certain requirements the malware analysis is all ways conserved the techniques in the prior, consequently dynamic analysis was considered. To identify and execute a complicate malware dynamic analysis methods are used. In dynamic analysis the malware shows how it operates and recognize the unknown malware which is identically operates like a known malware \hyperref[b31]{[32]}. There are two familiar primary dynamic methods are control flow analysis and API call analysis.  {\ref [33] [34]}.\par
API call data display how the malware gets operates and it can be obtained by both static and dynamic approaches. The API list and PE format of the executable files can be derived by the static approach \hyperref[b34]{[35]} [36] [37] \hyperref[b37]{[38]}. In dynamic approach. \hyperref[b38]{[39]} [40] \hyperref[b40]{[41]},  {\ref [42] [43]} [44] API calls can be recognized by running executable files it usually run in virtual machine.\par
In API call there two familiar ways to evaluate the data accumulated by static approach. The first one implements simple statistical analysis, for example, to count the frequency of API call which is aspect to organize malware \hyperref[b34]{[35]}. The second approach is to gather the API call data through data mining or machine learning techniques. In another way the API call sequence data which gathered by the dynamic approach are helpful to creates a behavioral patterns. The information accumulated by the dynamic approach also operates simple statistics such as frequency counting \hyperref[b38]{[39]} and data mining or machine learning \hyperref[b39]{[40]} [42] \hyperref[b43]{[44]}.\par
The API call analysis been done with API call approaches. In this abstraction the dynamic method is applied to excerpt API call sequences. To obtain austerity patterns, DNA sequence alignment algorithms (MSA and LCS) are adapted. With API call sequence patterns and the critical API call sequence, we can recognize the unknown malware or its variation with elevated efficiency.\par
Anderson et al. \hyperref[b48]{[49]} defined a malware detection strategy that builds a set of graphs from the given instruction set and then analyzes these graphs to notify the proneness of the malware activity. In order to build the graphs the markov chains were defined on 2gram sequences. The graphs defined form the training set further used to build a similarity matrix using graph kernel. The graph kernel is the mix of Gaussian and spectral kernels, which are in use to assess the similarity between graph edges and similarity between graphs respectively. Further the support vector machine that learns from the similarities between graph edges and graphs is used to classify the input call sequences.\par
By using such liberal malware software the multiple kernel is achieved and learning design used in this work to exhibit selective refined differences occurrence of malware. The inadequacy of this approach is computed consequence is very high, hence the use of this approach is discouraged.\par
Bayer et al. \hyperref[b49]{[50]} prospect a technique that groupsthe call sequences generated by Anubis \hyperref[b50]{[51]}. The behavior adequately of the call sequences is considered as objective to cluster the call sequences by Locality Sensitivity Hashing (LSH)  {\ref [52]}. The constraint of the model is that LSH is capable to generate probabilistic clusters.\par
Biley et al. \hyperref[b51]{[53]} argued that malware prototyping is not consistent among the notable antivirus products available. In order to this the authors devised a novel classification strategy that classifies the malware according to the changes observed at system state. A strategy that prototypes the behavior of the malware is used, further the malwares are classified according to these behavior prototypes. The distance between a class and a malware is assessed by the distance metric called "normalized compression distance (NCD)". The constraint observed in empirical study of this model is that the behavior prototype definition is static and limited to malwares that are not fall in zero-day category (unknown malwares). park et al. \hyperref[b52]{[54]} defined a classification strategy that classifies malware based on the graphs generated from the call sequences. Further graph similarities between confirmed malware call sequence graph and unknown call sequence graph will be assessed. The similarity index is the "max number of subgraphs identified in both graphs". The malwares those controls the system privileges without initiating the system call sequences are not traceable by this classification model, which is a significant constraint of this model. Firdausi et al. \hyperref[b54]{[55]}   
\section[{E}]{E}\par
In other way, researchers are analyzed more ways to develop API call sequence information. In earlier research API call had introduced API call graph \hyperref[b44]{[45]} with various kinds of call graph analysis. To get more consequential features for call graph analysis, the analyzer had espoused the mechanism of social network analysis. \hyperref[b45]{[46]} According to analyzers the affinity among API call sequences is based on cosine similarity function and lengthy jaccard measure. Due to modern research \hyperref[b32]{[33]} [34] \hyperref[b46]{[47]} [48] more information had been added such as control flow information and API argument information to inflate the efficiency in the mining process. by the model called Anubis \hyperref[b50]{[51]}. Further these observed behavioral patterns will be organized as sparse vectors and learns the behavior prototypes. The malware samples given for testing will be classified, which is based on the behavioral prototypes learned in training phase. The performance of the model is estimated through benchmark classifiers and they are "j48", "multilayer perception neural networks (MLP)" "Naïve Bayes", "Support Vector Machine (SVM)" and "k-Nearest Neighbors (kNN)". The experimental results indicating that the J48 classification delivered much classification accuracy.\par
Nari et al. \hyperref[b55]{[56]} devised a network flow behavioral analysis framework for malware detection. The network transactions obtained from PCAP files were considered to extract the network flows. Further a network activity representation graph is drawn from these network flows. The given network flows labeled as malware were used in training phase. Further this framework learns representation of the features such as size of the graph, average, maximum and root level outdegree and count of specific nodes of the network activity graphs of the given input network flows. Further these features specific information uses to classify the input malware samples in testing phase. In order to perform the classification, the WEKA library \hyperref[b56]{[57]} was used. The experimental study indicating that the J48 is the best classifier among all classifiers available in WEKA library.\par
Lee et al. \hyperref[b57]{[58]} explored a machine learning based malwares clustering. The training phase builds the behavioral profiles of the malware samples given as training data and the profile includes the system resources invoked by the system calls and their arguments. Further the similarities between behavioral profiles were considered distance function to cluster the malwares, which was done by k-medoids. The outliers are adjusted to the clusters based on the nearest neighbor strategy. This approach is the combination of static and dynamic clustering strategy that clusters known features by k-medoid and unknown and new features by nearest neighbor approach. This strategy is evincing that hybrid approach is more robust in order to classify the known as well as unknown features effectively.\par
Another hybrid approach for malware detection was devised by Santos et al. \hyperref[b58]{[59]}. This approach tracks the known features (static features) through the analysis of the sequence of operational codes in given malicious executable and the unknown features (dynamic features) were noticed from the observation of exceptions and operations in system calls. The experimental study was done under various classifiers and results obtained were evincing the significant accuracy in malware classification Islam et al. \hyperref[b59]{[60]} explored a similar strategy that extracts static and dynamic features to classify the executables into malevolent or benevolent. The features such as function length, function executable frequency and length of the strings involved are included in known features and the features such as function identity and function arguments are included in unknown features. The experiments were done using the classifiers called Support Vector Machine, Decision Tree and Random Forest and results evincing that the random forest is the best classifier among all considered.\par
The malware classification method devised by Anderson et al. \hyperref[b61]{[61]} is using the divergent input sources such as control flow graphs, static call sequences, portioned executables, dynamic call sequences and file signatures. Further this model learns the weight of these input combinations from the given training set of malevolent and benevolent executables. The observed weights of these input combinations are used further to classify the malevolent and benevolent executables during testing phase. The process overhead is the significant constraint of this model observed against dense and high speed network streams. 
\section[{III.}]{III.} 
\section[{Conclusion}]{Conclusion}\par
The current era of internet and computer systems are prone to serious security threats due to the malicious software which are also referred as malware. Hence the significant research contributions aimed to define malware detection and prevention strategies in contemporary literature. All of these contributions are fall in the categories of either anomaly based, signature based or call sequence analysis based detection. The signature based models are capable to notify and prevent the malwares that are notified earlier. In contrast to this the anomaly models and call sequence analysis models are capable to identify the malwares based on the similarities learned from previous malware attacks. The difference between the anomaly and call sequence analysis models is that the anomaly based learning models can adopt user defined features, whereas the call sequence analysis models notify the similarities learned from the call sequences of 2-gram, 3-gram or ngram. This manuscript aimed to affirm the objectives and limits of the contributions found in recent literature. The conclusion of the review evincing that the machine learning based models that learns from either anomalies or call sequence are tolerable the constraints observed in signature based malware detection strategies. The anomaly and call sequence learning models found in contemporary literature are not adequate to defend the challenges evincing from the vibrant and unjust network data. Hence the significant contributions are in demand to handle the challenges evinced in current era of internet and computer system usage. \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
 			\footnote{© 2016 Global Journals Inc. (US) 1} 			\footnote{© 2016 Global Journals Inc. (US)} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[ Annual Workshop on Cyber Security and Information Intelligence Research]{b53}\label{b53} 	 		\textit{},  	 	 		\textit{Annual Workshop on Cyber Security and Information Intelligence Research}  		 (45) .  	 
\bibitem[]{b60}\label{b60} 	 		\textit{},  		 \xref{http://dx.doi.org/10.1016/j.jnca.2012.10.004}{10.1016/j.jnca.2012.10.004}.  		 \url{http://dx.doi.org/10.1016/j.jnca.2012.10.004}  		 	 
\bibitem[Vinod ()]{b12}\label{b12} 	 		\textit{},  		 			P Vinod 		.  	 	 		\textit{Survey on Malware Detection Methods}  		2009.  	 
\bibitem[Berkenkopf and Malware ()]{b3}\label{b3} 	 		\textit{},  		 			R B S Berkenkopf 		,  		 			G-Data Malware 		.  		2010.  	 	 (Report) 
\bibitem[Mcafee ()]{b2}\label{b2} 	 		\textit{},  		 			Lab Mcafee 		.  		2013 Threats Predictions. 2013.  	 
\bibitem[Zhou ()]{b18}\label{b18} 	 		\textit{A Heuristic Approach for Detection of Obfuscated Malware},  		 			S T A M Zhou 		.  		2009. IEEE.  	 
\bibitem[Das ()]{b28}\label{b28} 	 		\textit{A Temporal Logic Based Approach to Multi-Agent Intrusion Detection and Prevention},  		 			Paritosh Das 		,  		 			RN 		.  		2012.  	 
\bibitem[Garfinkel and Rosenblum ()]{b20}\label{b20} 	 		\textit{A virtual machine introspection based architecture for intrusion detection},  		 			T Garfinkel 		,  		 			M Rosenblum 		.  		2003. p. .  	 
\bibitem[Ou and Ou ()]{b24}\label{b24} 	 		‘Agent-Based immunity for computer virus: abstraction from dendritic cell algorithm with danger theory’.  		 			C. -M Ou 		,  		 			C R Ou 		.  	 	 		\textit{Proceedings of the 5th international conference on Advances in Grid and Pervasive Computing},  				 (the 5th international conference on Advances in Grid and Pervasive ComputingHualien, Taiwan)  		2010. Springer-Verlag. p. .  	 
\bibitem[Ye ()]{b23}\label{b23} 	 		\textit{An Agent-Based Framework for Distributed Intrusion Detections},  		 			D Ye 		.  		2009.  	 
\bibitem[Firdausi et al. (2010)]{b54}\label{b54} 	 		‘Analysis of Machine Learning Techniques Used in Behavior Based Malware Detection’.  		 			I Firdausi 		,  		 			C Lim 		,  		 			A Erwin 		.  	 	 		\textit{Proceedings of 2nd International Conference on Advances in Computing, Control and Telecommunication Technologies (ACT)},  				 (2nd International Conference on Advances in Computing, Control and Telecommunication Technologies (ACT))  		2010. Jakarta, 2-3 December 2010. p. .  	 
\bibitem[Qiao et al. (2013)]{b43}\label{b43} 	 		‘Analyzing malware by abstracting the frequent item sets in API call sequences’.  		 			Y Qiao 		,  		 			Y Yang 		,  		 			L Ji 		,  		 			He 		.  	 	 		\textit{Proceedings of the 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom '13)},  				 (the 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom '13))  		July 2013. p. .  	 
\bibitem[Indyk and Motwani (1998)]{b50}\label{b50} 	 		‘Approximate Nearest Neighbor: Towards Removing the Curse of Dimensionality’.  		 			P Indyk 		,  		 			R Motwani 		.  		 \url{http://anubis.iseclab.org/52}  	 	 		\textit{Proceedings of 30th Annual ACM Symposium on Theory of Computing},  				 (30th Annual ACM Symposium on Theory of ComputingDallas)  		1998. May 1998. p. .  	 	 (Anubis) 
\bibitem[Mcgraw and Morrisett ()]{b0}\label{b0} 	 		\textit{Attacking Malicious Code: A Report to the Infosec Research Council},  		 			G Mcgraw 		,  		 			G Morrisett 		.  		2000. IEEE Softw. 17 p. .  	 
\bibitem[Biley et al. ()]{b51}\label{b51} 	 		‘Automated Classification and Analysis of Internet Malware’.  		 			M Biley 		,  		 			J Oberheid 		,  		 			J Andersen 		,  		 			Z Morley Mao 		,  		 			F Jahanian 		,  		 			J Nazario 		.  		 \xref{http://dx.doi.org/10.1007/978-3-540-74320-0_10}{10.1007/978-3-540-74320-0\textunderscore 10}.  		 \url{http://dx.doi.org/10.1007/978-3-540-74320-0\textunderscore 10}  	 	 		\textit{Proceedings of the 10 th International Conference on Recent Advances in Intrusion Detection},  				 (the 10 th International Conference on Recent Advances in Intrusion Detection)  		2007. 4637 p. .  	 
\bibitem[Automated dynamic binary analysis ()]{b15}\label{b15} 	 		\textit{Automated dynamic binary analysis},  		2007.  	 
\bibitem[Nari and Ghorbani (2013)]{b55}\label{b55} 	 		‘Automated Malware Classification Based on Network Behavior’.  		 			S Nari 		,  		 			A Ghorbani 		.  	 	 		\textit{Proceedings of International Conference on Computing, Networking and Communications (ICNC)},  				 (International Conference on Computing, Networking and Communications (ICNC)San Diego)  		2013. January 2013. p. .  	 
\bibitem[Rieck et al. ()]{b46}\label{b46} 	 		‘Automatic analysis of malware behavior using machine learning’.  		 			K Rieck 		,  		 			P Trinius 		,  		 			C Willems 		,  		 			T Holz 		.  	 	 		\textit{Journal of Computer Security}  		2011. 19  (4)  p. .  	 
\bibitem[Qiao et al. ()]{b42}\label{b42} 	 		‘CBM: free, automatic malware analysis framework using API call sequences’.  		 			Y Qiao 		,  		 			Y Yang 		,  		 			J He 		,  		 			C Tang 		,  		 			Z Liu 		.  	 	 		\textit{Knowledge Engineering and Management},  				 (Berlin, Germany)  		2014. Springer. p. .  	 
\bibitem[Cesare and Xiang ()]{b31}\label{b31} 	 		 			S Cesare 		,  		 			Y Xiang 		.  		\textit{Software Similarity and Classification},  				2012. Springer Science \& Business Media.  	 
\bibitem[Islam et al. ()]{b59}\label{b59} 	 		‘Classification of Malware Based on Integrated Static and Dynamic Features’.  		 			R Islam 		,  		 			R Tian 		,  		 			L Battenb 		,  		 			S Versteeg 		.  	 	 		\textit{Journal of Network and Computer Application}  		2013. 36 p. .  	 
\bibitem[Abadi et al. (2005)]{b33}\label{b33} 	 		‘Control-´flow integrity’.  		 			M Abadi 		,  		 			M Budiu 		,  		 			U Erlingsson 		,  		 			J Ligatti 		.  	 	 		\textit{Proceedings of the 12th ACM Conference on Computer and Communications Security},  				 (the 12th ACM Conference on Computer and Communications Security)  		November 2005. p. .  	 
\bibitem[Tian et al. (2010)]{b38}\label{b38} 	 		‘Differentiating malware from cleanware using behavioural analysis’.  		 			R Tian 		,  		 			M R Islam 		,  		 			L Batten 		,  		 			S Versteeg 		.  	 	 		\textit{Proceedings of the 5th International Conference on Malicious and Unwanted Software (MALWARE '10)},  				 (the 5th International Conference on Malicious and Unwanted Software (MALWARE '10)Nancy, France)  		October 2010. p. .  	 
\bibitem[Kolbitsch ()]{b17}\label{b17} 	 		‘Effective and efficient malware detection at the end host’.  		 			C Kolbitsch 		.  	 	 		\textit{Proceedings of the 18th conference on USENIX security symposium},  				 (the 18th conference on USENIX security symposiumMontreal, Canada)  		2009. p. .  	 	 (USENIX Association) 
\bibitem[Venugopal ()]{b16}\label{b16} 	 		‘Efficient signature based malware detection on mobile devices’.  		 			Deepak Venugopal 		,  		 			GH 		.  	 	 		\textit{Mob. Inf. Syst}  		2008. 4  (1)  p. .  	 
\bibitem[Park et al. ()]{b52}\label{b52} 	 		‘Fast Malware Classification by Automated Behavioral Graph Matching’.  		 			Y Park 		,  		 			D Reeves 		,  		 			V Mulukutla 		,  		 			B Sundaravel 		.  	 	 		\textit{Proceedings of the 6th},  				 (the 6th)  		2010.  	 
\bibitem[Lagar-Cavilla ()]{b21}\label{b21} 	 		\textit{Flexible Computing with Virtual Machines},  		 			H A Lagar-Cavilla 		.  		2009.  	 
\bibitem[Anderson et al. ()]{b48}\label{b48} 	 		‘Graph Based Malware Detection Using Dynamic Analysis’.  		 			B Anderson 		,  		 			D Quist 		,  		 			J Neil 		,  		 			C Storlie 		,  		 			T Lane 		.  		 \xref{http://dx.doi.org/10.1007/s11416-011-0152-x}{10.1007/s11416-011-0152-x}.  		 \url{http://dx.doi.org/10.1007/s11416-011-0152-x}  	 	 		\textit{Journal in Computer Virology}  		2011. 7 p. .  	 
\bibitem[Ye et al. (2007)]{b36}\label{b36} 	 		‘IMDS: intelligent malware detection system’.  		 			Y Ye 		,  		 			D Wang 		,  		 			T Li 		,  		 			D Ye 		.  	 	 		\textit{Proceedings of the 13th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining},  				 (the 13th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining)  		August 2007. ACM. p. .  	 
\bibitem[Anderson et al. ()]{b61}\label{b61} 	 		‘Improving Malware Classification: Bridging the Static/Dynamic Gap’.  		 			B Anderson 		,  		 			C Storlie 		,  		 			T Lane 		.  	 	 		\textit{Proceedings of 5 th ACM Workshop on Security and Artificial Intelligence (AISec)},  				 (5 th ACM Workshop on Security and Artificial Intelligence (AISec))  		2012. p. .  	 
\bibitem[Pinz ()]{b6}\label{b6} 	 		‘Improving the security level of the FUSION@ multi-agent architecture’.  		 			C I Pinz 		.  	 	 		\textit{Expert Syst. Appl}  		2012. 39  (8)  p. .  	 
\bibitem[Ye ()]{b4}\label{b4} 	 		‘Intelligent file scoring system for malware detection from the gray list’.  		 			Y Ye 		.  	 	 		\textit{Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining},  				 (the 15th ACM SIGKDD international conference on Knowledge discovery and data miningParis, France)  		2009. ACM. p. .  	 
\bibitem[Bijani and Robertson ()]{b25}\label{b25} 	 		‘Intrusion detection in open peer-to-peer multi-agent systems’.  		 			S Bijani 		,  		 			D Robertson 		.  	 	 		\textit{Proceedings of the 5 th international conference on Autonomous infrastructure, management, and security: managing the dynamics of networks and services},  				 (the 5 th international conference on Autonomous infrastructure, management, and security: managing the dynamics of networks and servicesNancy, France)  		2011. Springer Verlag. p. .  	 
\bibitem[Shankarapani et al. (2010)]{b39}\label{b39} 	 		‘Kernel machines for malware classification and similarity analysis’.  		 			M Shankarapani 		,  		 			K Kancherla 		,  		 			S Ramammoorthy 		,  		 			R Movva 		,  		 			S Mukkamala 		.  	 	 		\textit{Proceedings of the International Joint Conference on Neural Networks (IJCNN '10)},  				 (the International Joint Conference on Neural Networks (IJCNN '10))  		July 2010. p. .  	 
\bibitem[Lee and Mody ()]{b57}\label{b57} 	 		 			T Lee 		,  		 			J J Mody 		.  		\textit{Behavioral Classification. Proceedings of the European Institute for Computer Antivirus Research Conference (EICAR'06)},  				2006.  	 
\bibitem[Moser et al. (2007)]{b29}\label{b29} 	 		‘Limits of static analysis for malware detection’.  		 			C Moser 		,  		 			E Kruegel 		,  		 			Kirda 		.  	 	 		\textit{Proceedings of the 23rd Annual Computer Security Applications Conference (ACSAC '07)},  				 (the 23rd Annual Computer Security Applications Conference (ACSAC '07))  		December 2007. p. .  	 
\bibitem[Rieck ()]{b5}\label{b5} 	 		\textit{Malheur A novel tool for malware analysis},  		 			K Rieck 		.  		2012.  	 
\bibitem[Jang et al. ()]{b45}\label{b45} 	 		‘Malnetminer: malware classification based on social network analysis of call graph’.  		 			J. -W Jang 		,  		 			J Woo 		,  		 			J Yun 		,  		 			H K Kim 		.  	 	 		\textit{Proceedings of the Companion Publication of the 23rd International Conference on World Wide Web Companion (WWW Companion '14)},  				 (the Companion Publication of the 23rd International Conference on World Wide Web Companion (WWW Companion '14))  		2014. p. .  	 	 (International World Wide Web Conferences Steering Committee) 
\bibitem[Ahmed et al. ()]{b7}\label{b7} 	 		‘Malware Detection Based on Hybrid Signature Behaviour Application Programming Interface Call Graph’.  		 			Ammar Ahmed 		,  		 			E Elhadi 		,  		 			M A Maarof 		,  		 			A H Osman 		.  	 	 		\textit{American Journal of Applied Sciences}  		2012. 9  (3)  p. .  	 
\bibitem[Sami et al. (2010)]{b35}\label{b35} 	 		‘Malware detection based on mining API calls’.  		 			B Sami 		,  		 			H Yadegari 		,  		 			N Rahimi 		,  		 			S Peiravian 		,  		 			A Hashemi 		,  		 			Hamze 		.  	 	 		\textit{Proceedings of the 25th Annual ACM Symposium on Applied Computing (SAC '10)},  				 (the 25th Annual ACM Symposium on Applied Computing (SAC '10))  		March 2010. ACM. p. .  	 
\bibitem[Shankarapani et al. ()]{b40}\label{b40} 	 		‘Malware detection using assembly and API call sequences’.  		 			M K Shankarapani 		,  		 			S Ramamoorthy 		,  		 			R S Movva 		,  		 			S Mukkamala 		.  	 	 		\textit{Journal in Computer Virology}  		2011. 7  (2)  p. .  	 
\bibitem[Xufang et al. ()]{b1}\label{b1} 	 		‘Mechanisms of Polymorphic and Metamorphic Viruses’.  		 			L Xufang 		,  		 			P K K Loh 		,  		 			F Tan 		.  	 	 		\textit{Intelligence and Security Informatics Conference (EISIC)},  				2011 European. 2011.  	 
\bibitem[Yanfang Ye et al. ()]{b9}\label{b9} 	 		‘MelihAbdulhayoglu, Combining file content and file relations for cloud based malware detection’.  		 			T L Yanfang Ye 		,  		 			Weiwei Shenghuo Zhu 		,  		 			Zhuang 		,  		 			Umesh Egementas 		,  		 			Gupta 		.  	 	 		\textit{Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining},  				 (the 17th ACM SIGKDD international conference on Knowledge discovery and data miningSan Diego, California, USA)  		2011. ACM. p. .  	 
\bibitem[Kevadia Kaushal and Prajapati ()]{b8}\label{b8} 	 		‘Metamorphic Malware Detection Using Statistical Analysis’.  		 			P S Kevadia Kaushal 		,  		 			Nilesh Prajapati 		.  	 	 		\textit{International Journal of Soft Computing and Engineering (IJSCE)}  		2012.  (2) .  	 
\bibitem[Gorodetsky ()]{b22}\label{b22} 	 		\textit{Multi-agent Peer-to-Peer Intrusion Detection Computer Network Security},  		 			V Gorodetsky 		.  		2007. Berlin Heidelberg: Springer. p. .  	 
\bibitem[Ou ()]{b27}\label{b27} 	 		\textit{Multiagent-based computer virus detection systems: abstraction from dendritic cell algorithm with danger theory},  		 			C M Ou 		.  		2011. Springerlink.  	 
\bibitem[Ahmed ()]{b19}\label{b19} 	 		‘NIDS: A Network Based Approach to Intrusion Detection and Prevention’.  		 			M Ahmed 		.  	 	 		\textit{Computer Science and Information Technology -Spring Conference},  				2009. 2009.  	 
\bibitem[Okane et al. ()]{b30}\label{b30} 	 		‘Obfuscation: the hidden malware’.  		 			P Okane 		,  		 			S Sezer 		,  		 			K Mclaughlin 		.  	 	 		\textit{IEEE Security \& Privacy}  		2011. 9  (5)  p. .  	 
\bibitem[Santos et al. ()]{b58}\label{b58} 	 		‘OPEM: A Static-Dynamic Approach for Machine Learning Based Malware Detection’.  		 			I Santos 		,  		 			J Devesa 		,  		 			F Brezo 		,  		 			J Nieves 		,  		 			P G Bringas 		.  	 	 		\textit{Proceedings of International Conference CISIS'12-ICEUTE'12, Special Sessions Advances in Intelligent Systems and Computing},  				 (International Conference CISIS'12-ICEUTE'12, Special Sessions Advances in Intelligent Systems and Computing)  		2013. 189 p. .  	 
\bibitem[Yin ()]{b11}\label{b11} 	 		‘Panorama: capturing systemwide information flow for malware detection and analysis’.  		 			H Yin 		.  	 	 		\textit{Proceedings of the 14th ACM conference on Computer and communications security},  				 (the 14th ACM conference on Computer and communications securityAlexandria, Virginia, USA)  		2007. ACM. p. .  	 
\bibitem[Linn et al. (2005)]{b47}\label{b47} 	 		‘Protecting against unexpected system calls’.  		 			C M Linn 		,  		 			M Rajagopalan 		,  		 			S Baker 		,  		 			C Collberg 		,  		 			S K Debray 		,  		 			J H Hartman 		.  	 	 		\textit{Proceedings of the 14th USENIX Security Symposium},  				 (the 14th USENIX Security SymposiumBaltimore, Md, USA)  		August 2005. p. .  	 
\bibitem[Dong ()]{b26}\label{b26} 	 		‘Research on adaptive distributed intrusion detection system model based on Multi-Agent’.  		 			H Dong 		.  	 	 		\textit{Computer Science and Automation Engineering (CSAE), 2011 IEEE International Conference on},  				2011.  	 
\bibitem[Bayer et al. ()]{b49}\label{b49} 	 		‘Scalable, Behavior-Based Malware Clustering’.  		 			U Bayer 		,  		 			P M Comparetti 		,  		 			C Hlauschek 		,  		 			C Kruegel 		.  	 	 		\textit{Proceedings of the 16th Annual Network and Distributed System Security Symposium},  				 (the 16th Annual Network and Distributed System Security Symposium)  		2009.  	 
\bibitem[Christodorescu ()]{b10}\label{b10} 	 		‘Semantics-Aware Malware Detection’.  		 			M Christodorescu 		.  	 	 		\textit{Proceedings of the 2005 IEEE Symposium on Security and Privacy},  				 (the 2005 IEEE Symposium on Security and Privacy)  		2005. IEEE Computer Society. p. .  	 
\bibitem[Sathyanarayan et al. ()]{b34}\label{b34} 	 		‘Signature generation and detection of malware families’.  		 			S Sathyanarayan 		,  		 			P Kohli 		,  		 			B Bruhadeshwar 		.  	 	 		\textit{Information Security and Privacy},  				 (Berlin, Germany)  		2008. Springer.  	 
\bibitem[Bergeron et al. ()]{b44}\label{b44} 	 		‘Static detection of malicious code in executable programs’.  		 			J Bergeron 		,  		 			M Debbabi 		,  		 			J Desharnais 		,  		 			M M Erhioui 		,  		 			Y Lavoie 		,  		 			N Tawbi 		.  	 	 		\textit{Proceedings of the Symposium on Requirements Engineering for Information Security (SREIS '01)},  				 (the Symposium on Requirements Engineering for Information Security (SREIS '01))  		2001.  	 
\bibitem[Jiang et al. ()]{b14}\label{b14} 	 		\textit{Stealthy malware detection through vmm-based "outof-the-box" semantic view reconstruction, in Computer and communications security},  		 			X Jiang 		,  		 			X Wang 		,  		 			D Xu 		.  		2007. Alexandria, Virginia, USA: ACM. p. .  	 
\bibitem[Rajagopalan et al. ()]{b32}\label{b32} 	 		‘System call monitoring using authenticated system calls’.  		 			M Rajagopalan 		,  		 			M A Hiltunen 		,  		 			T Jim 		,  		 			R D Schlichting 		.  	 	 		\textit{IEEE Transactions on Dependable and Secure Computing}  		2006. 3  (3)  p. .  	 
\bibitem[Hall et al. ()]{b56}\label{b56} 	 		‘The WEKA Data Mining Software: An Update’.  		 			M Hall 		,  		 			E Frank 		,  		 			G Holmes 		,  		 			B Pfahringer 		,  		 			P Reutemann 		,  		 			I Witten 		.  	 	 		\textit{ACM SIGKDD Explorations Newsletter}  		2009. p. .  	 
\bibitem[Ahmed et al. (2009)]{b41}\label{b41} 	 		‘Using spatiotemporal linformationin API call swithmachinelea rning algorithms for malware detection’.  		 			F Ahmed 		,  		 			H Hameed 		,  		 			M Z Shafiq 		,  		 			M Farooq 		.  	 	 		\textit{Proceedings of the 2nd ACM Workshop on Security and Artificial Intelligence},  				 (the 2nd ACM Workshop on Security and Artificial Intelligence)  		November 2009. p. .  	 
\bibitem[Zeltser]{b13}\label{b13} 	 		\textit{what is cloud Anti-Virus and how it does work},  		 			L Zeltser 		.  		 	 
\bibitem[Alazab et al. (2011)]{b37}\label{b37} 	 		‘Zeroday malware detection based on supervised learning algorithms of API call signatures’.  		 			M Alazab 		,  		 			S Venkatraman 		,  		 			P Watters 		.  	 	 		\textit{Proceedings of the 9 th Australasian Data Mining Conference (AusDM '11)},  				 (the 9 th Australasian Data Mining Conference (AusDM '11))  		December 2011. Australian Computer Society. 121 p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
