Abstract
Anti-malware tools remain the primary line of defense against malicious software. There is a wide variety of commercial anti-malware tools in the IT security market. However, no single tool is able to provide a full protection against the overwhelming number of daily released malware. Hence, collaboration among malware detection tools is of paramount importance. In this paper, we propose MACoMal, a multi-agent based decision mechanism, which assists heterogeneous anti-malware tools to collaborate with each other in order to reach a consensual decision about the maliciousness of a suspicious file. MACoMal consists of two main elements: (1) an executable file identification model, and (2) a collaborative decision-making scheme. MACoMal is analyzed with respect to network connectivity and global decision correctness. By leveraging a multi-agent simulation tool and a set of real malware samples, we present a simulation methodology to assess its effectiveness and efficiency. Experimental results show that MACoMal is able to immunize a network against a malware threat within a time that ranges from a few seconds to a few minutes after the threat detection.