Interpretable Rules with a Simplified Data Representation - a Case Study with the EMBER Dataset

The EMBER dataset is a popular malware samples dataset open to researchers to evaluate. Despite its wide coverage in various proposals and papers, there are no evaluations of EMBER with a simplified (binary) data representation. In this paper, we propose 1) a simplified data representation of EMBER and 2) a proprietary feature selection method called ESFS (Ember Special Feature Selection) tailored to this representation. We demonstrate that simplified data representation is a viable alternative to the original representation and that the ESFS method improves the performance of all evaluated models above the conventional methods (Pearson correlation and information gain). Lastly, we use the best-performing model (J48) to extract and visualise several example rules for malware classification.