Therefore, our approach was aimed at focusing the experts' efforts on the most informative files.
Introduction of the stream of day (d + 1) to the selective sampling method which chooses the X most informative files according to its criteria and sends them to the expert for manual analysis and labeling 4.
However, our methods, combination and exploitation, are more oriented toward acquiring the most informative files and most likely malware by obtaining informative PDF files from the malicious side of the SVM margin.
On the one hand, the combination method begins by acquiring examples based on SVM-Margin criteria in order to acquire the most informative PDF files, acquiring both malicious and benign files.
Next, from this same stream, the selective sampling method selected the most informative PDF files according to that method's criteria.
The framework seeks to acquire the most informative PDF files, benign and malicious, in order to improve classifier performance, enabling it to frequently discover and enrich the signature repository of anti-virus tools with new unknown malware.
Out of these files, the most informative ones are the VCF files, which contains the genetic variants for both normal and tumor samples.
Therefore, these suboptimal HCs were omitted from further analyses, reducing the final data set from 126,996 reads to 123,003 most informative HCs (Additional file 1, Table S4).
The input features related to evolutionary information were consistently most informative for SNAP2 (Additional File 1, Fig. SOM_1: SNAP2 vs. SNAP2noali).
Updating the predictive capabilities of the detection model that serves as the knowledge store of AL methods and improving its ability to efficiently identify the most informative new malicious PDF files.
In a nutshell, our AL based framework was able to better induce an updated detection model on a daily basis, outperforming all the anti-virus tools and managing to accomplish this using only a fraction of the new PDF files (25%%)—the most informative portion, consisting of the most valuable information required for updating the knowledge stores of the detection model and anti-virus tools.
