In the past few years, the amount of malicious software increased exponentially and, therefore, machine learning algorithms became instrumental in identifying clean and malware files through (semi)-automated classification. When working with very large datasets, the major challenge is to reach both a very high malware detection rate and a very low false positive rate. Another challenge is to minimize the time needed for the machine learning algorithm to do so. This paper presents a comparative study between different machine learning techniques such as linear classifiers, ensembles, decision trees or various hybrids thereof. The training dataset consists of approximately 2 million clean files and 200.000 infected files, which is a realistic quantitative mixture. The paper investigates the above mentioned methods with respect to both their performance (detection rate and false positive rate) and their practicability., {"references":["Mihai Cimpoesu, Dragos Gavrilut, and Adrian Popescu. The proactivity\nof perceptron derived algorithms in malware detection. Journal in\nComputer Virology, 8(4):133–140, 2012.","Pedro Domingos. Metacost: A general method for making classifiers\ncost-sensitive. In Proceedings of the Fifth ACM SIGKDD International\nConference on Knowledge Discovery and Data Mining, San Diego, CA,\nUSA, August 15-18, 1999, pages 155–164, 1999.","Dragos Gavrilut, Razvan Benchea, and Cristina Vatamanu. Optimized\nzero false positives perceptron training for malware detection. In\n14th International Symposium on Symbolic and Numeric Algorithms for\nScientific Computing, SYNASC 2012, Timisoara, Romania, September\n26-29, 2012, pages 247–253, 2012.","Dragos Gavrilut, Mihai Cimpoesu, Dan Anton, and Liviu Ciortuz.\nMalware detection using machine learning. In Proceedings of the\nInternational Multiconference on Computer Science and Information\nTechnology, IMCSIT 2009, Mragowo, Poland, 12-14 October 2009,\npages 735–741, 2009.","Yongtao Hu, Liang Chen, Ming Xu, Ning Zheng, and Yanhua Guo.\nUnknown malicious executables detection based on run-time behavior.\nIn Fifth International Conference on Fuzzy Systems and Knowledge\nDiscovery, FSKD 2008, 18-20 October 2008, Jinan, Shandong, China,\nProceedings, Volume 4, pages 391–395, 2008.","Aleksander Kocz and Joshua Alspector. Svm-based filtering of\ne-mail spam with content-specific misclassification costs. In\nIN PROCEEDINGS OF THE WORKSHOP ON TEXT MINING\n(TEXTDM2001, 2001.","Jeremy Z. Kolter and Marcus A. Maloof. Learning to detect and\nclassify malicious executables in the wild. Journal of Machine Learning\nResearch, 6:2721–2744, 2006.","Yi-Bin Lu, Shu-Chang Din, Chao-Fu Zheng, and Bai-Jian Gao. Using\nmulti-feature and classifier ensembles to improve malware detection.\nJournal of C.C.I.T., 39(2), 2010.","Thomas R. Lynam, Gordon V. Cormack, and David R. Cheriton. On-line\nspam filter fusion. In SIGIR 2006: Proceedings of the 29th Annual\nInternational ACM SIGIR Conference on Research and Development\nin Information Retrieval, Seattle, Washington, USA, August 6-11, 2006,\npages 123–130, 2006.\n[10] Eitan Menahem, Asaf Shabtai, Lior Rokach, and Yuval Elovici.\nImproving malware detection by applying multi-inducer ensemble.\nComputational Statistics & Data Analysis, 53(4):1483–1494, 2009.\n[11] Robert Moskovitch, Yuval Elovici, and Lior Rokach. Detection of\nunknown computer worms based on behavioral classification of the host.\nComputational Statistics & Data Analysis, 52(9):4544–4566, 2008.\n[12] Robert Moskovitch, Clint Feher, Nir Tzachar, Eugene Berger, Marina\nGitelman, Shlomi Dolev, and Yuval Elovici. Unknown malcode detection\nusing OPCODE representation. In Intelligence and Security Informatics,\nFirst European Conference, EuroISI 2008, Esbjerg, Denmark, December\n3-5, 2008. Proceedings, pages 204–215, 2008.\n[13] Mehmet Ozdemir and Ibrahim Sogukpinar. An android malware\ndetection architecture based on ensemble learning. Transactions on\nMachine Learning and Artificial Intelligence, 2(3), 2014.\n[14] Matthew G. Schultz, Eleazar Eskin, Erez Zadok, and Salvatore J. Stolfo.\nData mining methods for detection of new malicious executables. In\n2001 IEEE Symposium on Security and Privacy, Oakland, California,\nUSA May 14-16, 2001, pages 38–49, 2001.\n[15] Dong-Her Shih, Hsiu-Sen Chiang, and David C. Yen. Classification\nmethods in the detection of new malicious emails. Inf. Sci.,\n172(1-2):241–261, 2005.\n[16] Konstantin Tretyakov. Machine learning techniques in spam filtering.\nData Mining Problem-oriented Seminar, 3(177):60–79, 2004.\n[17] Wen-tau Yih, Joshua Goodman, and Geoff Hulten. Learning at low false\npositive rates. In CEAS 2006 - The Third Conference on Email and\nAnti-Spam, July 27-28, 2006, Mountain View, California, USA, 2006.\n[18] Boyun Zhang, Jianping Yin, Jingbo Hao, Dingxing Zhang, and Shulin\nWang. Malicious codes detection based on ensemble learning. In\nAutonomic and Trusted Computing, 4th International Conference, ATC\n2007, Hong Kong, China, July 11-13, 2007, Proceedings, pages\n468–477, 2007."]}