Effective and efficient malware detection is at the forefront of research
into building secure digital systems. As with many other fields, malware
detection research has seen a dramatic increase in the application of machine
learning algorithms. One machine learning technique that has been used widely
in the field of pattern matching in general-and malware detection in
particular-is hidden Markov models (HMMs). HMM training is based on a hill
climb, and hence we can often improve a model by training multiple times with
different initial values. In this research, we compare boosted HMMs (using
AdaBoost) to HMMs trained with multiple random restarts, in the context of
malware detection. These techniques are applied to a variety of challenging
malware datasets. We find that random restarts perform surprisingly well in
comparison to boosting. Only in the most difficult "cold start" cases (where
training data is severely limited) does boosting appear to offer sufficient
improvement to justify its higher computational cost in the scoring phase.

通过将 AdaBoost 技术与多个随机重启训练的隐马尔可夫模型（HMMs）进行比较，我们发现在应对具有挑战性的恶意软件数据集时，随机重启表现出令人惊讶的良好性能，只有在训练数据严重受限的最困难的 “冷启动” 情况下，AdaBoost 才显著改善且可较高计算成本来进行评分阶段的义学。