Kernel Mixture Correntropy Conjugate Gradient Algorithm for Time Series Prediction

Abstract

Kernel adaptive filtering (KAF) is an effective nonlinear learning algorithm, which has been widely used in time series prediction. The traditional KAF is based on the stochastic gradient descent (SGD) method, which has slow convergence speed and low filtering accuracy. Hence, a kernel conjugate gradient (KCG) algorithm has been proposed with low computational complexity, while achieving comparable performance to some KAF algorithms, e.g., the kernel recursive least squares (KRLS). However, the robust learning performance is unsatisfactory, when using KCG. Meanwhile, correntropy as a local similarity measure defined in kernel space, can address large outliers in robust signal processing. On the basis of correntropy, the mixture correntropy is developed, which uses the mixture of two Gaussian functions as a kernel function to further improve the learning performance. Accordingly, this article proposes a novel KCG algorithm, named the kernel mixture correntropy conjugate gradient (KMCCG), with the help of the mixture correntropy criterion (MCC). The proposed algorithm has less computational complexity and can achieve better performance in non-Gaussian noise environments. To further control the growing radial basis function (RBF) network in this algorithm, we also use a simple sparsification criterion based on the angle between elements in the reproducing kernel Hilbert space (RKHS). The prediction simulation results on a synthetic chaotic time series and a real benchmark dataset show that the proposed algorithm can achieve better computational performance. In addition, the proposed algorithm is also successfully applied to the practical tasks of malware prediction in the field of malware analysis. The results demonstrate that our proposed algorithm not only has a short training time, but also can achieve high prediction accuracy.

1. Introduction

Usually, traditional time series prediction methods mainly include autoregression, Kalman filtering, and moving average models. These traditional approaches focus on mathematical statistics and have no capabilities of self-learning, self-organization, and self-adaption. In particular, they cannot be effectively used for data types of nonlinear and multi-feature dimensions in analyzing some complex problems. Currently, there are some machine learning methods developed to address this issue, such as support vector machine (SVM), artificial neural network (ANN), and deep neural network (DNN), then some satisfactory results are achieved in dealing with practical applications, e.g., malware analysis [1,2]. However, there still exists several issues that need to be addressed in using SVM, ANN, and DNN, such as long training time and difficulty in parameter determination. Therefore, it has become critical to seek a better machine learning model [3].

The kernel method as an effective nonlinear system modeling technique has been widely used in the machine learning community [4,5]. Among the available kernel learning methods, the kernel adaptive filtering (KAF) has become a popular calculation method with good computing performance, which has been successfully employed in signal processing, time series prediction, and many others. The main idea of KAF is to map the input data in the original space to the high-dimensional feature space, that is the reproducing kernel Hilbert space (RKHS) [6]. Then, a linear algorithm in this high-dimensional feature space can be applied to solve the nonlinear problem in the original space. The disadvantage of the feature space is that the computational complexity of algorithm increases exponentially with the dimensionality. However, because the kernel method is implicit, it uses kernel function calculation to replace the inner product calculation in high-dimensional feature space. Thus, the issue that the computational complexity increases rapidly with the dimensionality could be effectively avoided.

With the comprehensive study of nonlinear adaptive filters, more extended KAF algorithms have been developed in recent years. In this case, some popular KAF algorithms include kernel least mean squares (KLMS) [7] and kernel recursive least squares (KRLS) [8]. The algorithm KLMS has been widely used in the field of adaptive signal processing due to its simplicity and efficiency [9]. The algorithm KRLS is designed by recursively solving the least squares (LS) problem. Compared with KLMS, KRLS achieves better filtering accuracy and faster convergence speed at the cost of increased computing and storage. Meanwhile, the conjugate gradient (CG) method is another optimization strategy, and it provides a tradeoff between convergence rate and computational complexity, which can generate a better optimal solution than the stochastic gradient descent (SGD) method [10]. Therefore, the method CG has been successfully applied to KAF, and the kernel conjugate gradient (KCG) algorithm was proposed [11]. The KCG with low computational complexity can achieve the same performance as KRLS.

However, the above algorithms are all deduced and experimented in a Gaussian noise environment. This assumption may not be accurate, since the system noise does not always follow the Gaussian distribution in practical applications. Actually, it is accompanied by some impulse noise with low frequency and large amplitude. The interference of this impulse noise on the system is not negligible. In this case, the KAF algorithm derived on the basis of Gaussian noise environment is sensitive to non-Gaussian noise or outliers. As a robust nonlinear similarity measure in kernel space, correntropy has received more and more attention in the field of machine learning and signal processing [12]. Correntropy can capture higher-order statistics of errors and provide significant performance improvement on filtering precision, particularly in non-Gaussian environments. Therefore, more and more algorithms use correntropy as a cost function to improve the stability of algorithms in a non-Gaussian noise environment [13,14]. Furthermore, on the basis of correntropy, the mixture correntropy was proposed [15]. It uses a mixture of two Gaussian functions as a kernel function to enhance flexibility and improve the performance.

Motivated by the work mentioned above, in order to improve the filtering accuracy, convergence speed, and robustness against impulse noise at the same time, the mixture correntropy criterion (MCC) [11] is applied to KCG method. Then, a novel kernel learning algorithm, called kernel mixture correntropy conjugate gradient (KMCCG), is accordingly proposed in this article. In fact, MCC cannot be directly applied to the CG method due to its nonconvexity [15]. Therefore, in accordance with the conjugate function theory, we use the half-quadratic optimization method to transform the mixture correntropy loss into the mixture correntropy half-quadratic function. Then, the mixture correntropy can be smoothly applied to the CG method. Finally, according to the kernel technique, the algorithm KMCCG is proposed for robust online kernel learning. Moreover, in the weight updating, the KAF embeds a growing memory structure, i.e., a growing radial basis function (RBF) network, which leads to the increase of the memory requirement and computation of KAF. There are many traditional methods to restrain the growth of the network structure, such as the novelty criterion [16], the correlation criterion [17], the approximate linear dependence criterion [8], and the surprise criterion [18]. Since the angle between two elements in the Hilbert space can be expressed by the inner product and the similarity of elements in Hilbert space can be measured by the angle, here we use a sparsification criterion based on the angle among elements. The angle criterion used here not only provides geometric intuition, but also offers a simple structure that can be implemented easily.

With the rapid advancement of Internet technology [19], the issue of network security imposes huge challenges to the Internet. Specifically, the demand for malware analysis has become increasingly urgent, and practitioners and researchers have been making progress in the field of malware prediction and detection [20]. Usually, malware is able to implement intention by calling the existing application programming interface (API) in the system. Therefore, the API calling time series as a software behavior is analyzed to achieve malware prediction and detection [21]. Generally speaking, the obtained API call time series can be used to predict future malicious behavior. Specifically, in this article, the proposed algorithm KMCCG is also used in the practical application of malware prediction.

The main contributions of this article are summarized as follows. (1) On the basis of mixture correntropy, a novel robust algorithm KMCCG is proposed through a comprehensive use of the half-quadratic optimization method, the CG technique, and the kernel trick. KMCCG cannot only improve the learning accuracy, but also maintain robustness to impulse noise. (2) In view of the issue that the algorithm KMCCG will produce a growing RBF network, the sparsification criterion based on the angle is used to control the network structure. (3) For a special time series analysis application in relation to malware prediction, KMCCG is accordingly used to achieve this task, which verifies that our proposed algorithm can achieve higher prediction accuracy with less training time.

The rest of this article is organized as follows. In Section 2, the mixture correntropy, the algorithm KCG, and the sparsification criterion are introduced. In Section 3, the details of our algorithm KMCCG are presented. In Section 4, the simulation on time series prediction and the experiment on the malware prediction task are conducted to verify the effectiveness of the our proposed algorithm. The conclusion is summarized in Section 5.

2. Related Work

2.1. Mixture Correntropy

Correntropy is a local similarity function, which is defined as the generalized correlation in kernel space. It is closely related to the cross-information potential (CIP) in information theory learning (ITL) [22]. It shows very promising results in nonlinear non-Gaussian signal processing. The main property of correntropy is that it provides an effective mechanism to mitigate the influence of large outliers. Recently, correntropy has been successfully applied in various areas, such as signal processing [23], machine learning [24,25,26], adaptive filtering [27,28,29], and others [30,31,32].

The correntropy is used to represent the similarity between two random variables X and Y. Let $k_{\sigma }(·,·)$ be a Mercer kernel function with a kernel bandwidth of $\sigma$. Let $\mathbb{E}[·]$ be the mathematical expectation. Then, the correntropy can be defined as:

$$\begin{array}{c}\hfill V(X,Y)=\mathbb{E}\left[k_{\sigma }(X,Y)\right].\end{array}$$

(1)

Generally, the Gaussian kernel is the most widely-used kernel in correntropy, and it is as follows:

$$k_{\sigma }(X,Y)=G_{\sigma }(e)=\frac{1}{\sqrt{2\pi }\sigma }exp\left(-\frac{e^2}{2{\sigma }^2}\right),$$

(2)

where $e=X-Y$ is the error value.

Here, a nonlinear mapping $\phi (·)$ is used by the kernel function to map the input space $\mathcal{U}$ to high-dimensional space $\mathcal{F}$, and it satisfies $\langle \phi (x),\phi (y)\rangle =k_{\sigma }(X,Y)$. Then, (1) is rewritten as:

$$V(X,Y)=E[\langle \phi (X),\phi (Y)\rangle ].$$

(3)

Since the joint probability density of data in practical applications is usually unknown, for a finite sample ${\{x_i,y_i\}}_{i=1}^N$, the correntropy can be defined as:

$$\widehat{V}(X,Y)=\frac{1}{N}\sum _{i=1}^N{k}_{\sigma }(x_i-y_i).$$

(4)

Generally, the kernel bandwidth is one of the key parameters in correntropy. Usually, a small kernel bandwidth makes the algorithm more robust to outliers, but it will lead to slow convergence and poor accuracy. On the other hand, when the kernel bandwidth increases, the robustness will be significantly reduced in the case of abnormal values. In order to achieve better performance, a new similarity measure MCC was proposed [11]. It can achieve faster convergence speed and higher filtering accuracy, while maintaining robustness to outliers. The mixture correntropy uses the mixture of two Gaussian functions as the kernel function, and its definition is as follows:

$$M(X,Y)=\mathbb{E}[\alpha G_{{\sigma }_1}(e)+(1-\alpha )G_{{\sigma }_2}(e)],$$

(5)

where $0⩽\alpha ⩽1$ is the mixture coefficient and ${\sigma }_1$ and ${\sigma }_2$ are the kernel bandwidths of the Gaussian functions $G_{{\sigma }_1}(·)$ and $G_{{\sigma }_2}(·)$, respectively. When the mixture coefficient $\alpha$ takes a suitable value, the performance of MCC can be better than that of the original correntropy criterion, so the mixture correntropy is a more flexible measure of similarity.

Typically, the empirical mixture correntropy loss can be expressed as $\widehat{L}(X,Y)$ or $\widehat{L}(e)$, where $X={[x_1,x_2,\cdots ,x_N]}^{\mathrm{T}}$, $Y={[y_1,y_2,\cdots ,y_N]}^{\mathrm{T}}$, and $e={[e_1,e_2,\cdots ,e_N]}^{\mathrm{T}}$. Then, it is defined as follows:

$$\begin{array}{cc}\hfill \widehat{L}(X,Y)& =1-\widehat{M}(X,Y)\hfill \\ & =1-\frac{1}{N}\sum _{i=1}^N\left[\alpha G_{{\sigma }_1}\left(e_i\right)+(1-\alpha )G_{{\sigma }_2}\left(e_i\right)\right],\hfill \end{array}$$

(6)

where $e_i=x_i-y_i$.

Here, the Hessian matrix of $\widehat{L}(e)$ with respect to e is:

$${\mathbf{H}}_{\widehat{L}(e)}\left(e\right)=\left[\frac{{\partial }^2\widehat{L}(e)}{\partial e_i\partial e_j}\right]=\mathrm{diag}[{\zeta }_1,{\zeta }_2,\cdots ,{\zeta }_N],$$

(7)

where ${\zeta }_i=\alpha \frac{{\sigma }_1^2-e_i^2}{N{\sigma }_1^4}{G}_{{\sigma }_1}(e_i)+(1-\alpha )\frac{{\sigma }_2^2-e_i^2}{N{\sigma }_2^4}{G}_{{\sigma }_2}(e_i)$. Here, if $\left|e_i\right|⩽{\sigma }_1⩽{\sigma }_2$, then ${\zeta }_i>0$. For any point that satisfies ${∥e∥}_{\infty }⩽{\sigma }_1⩽{\sigma }_2$, there is ${\mathbf{H}}_{\widehat{L}(e)}\left(e\right)⩾0$.

It can be seen that the Hessian matrix ${\mathbf{H}}_{\widehat{L}(e)}$ of empirical mixture correntropy loss, as a function of e, is convex when the condition ${\parallel e\parallel }_{\infty }=\underset{1⩽i⩽N}{max}\left|e_i\right|⩽{\sigma }_1$ is satisfied. Therefore, the use of mixture correntropy as a loss function cannot be directly applied to convex optimization [33].

2.2. Kernel Conjugate Gradient Algorithm

The CG is a specific method between the steepest descent and the Newton methods. It accelerates the typically slow convergence associated with the steepest descent, while avoiding the information requirements associated with the evaluation, storage, and inversion of Hessian as required by Newton’s method [10].

Let $\mathbf{A}\in R^{n\times n}$ be a symmetric positive definite matrix and ${\mathit{d}}_1,{\mathit{d}}_2,\cdots ,{\mathit{d}}_m$ be a set of non-zero vectors in $R^n$. If ${\mathit{d}}_i^{\mathrm{T}}\mathbf{A}{\mathit{d}}_j=\mathbf{0}(i\ne j)$, then we think that ${\mathit{d}}_1,{\mathit{d}}_2,\cdots ,{\mathit{d}}_m$ are conjugated to each other about $\mathbf{A}$.

There is an unconstrained optimization problem as follows:

$$\underset{x\in R^n}{min}f(x),$$

(8)

where f is a continuous differentiable function on $R^n$. The nonlinear method CG for solving the above (8) has the following iterative format:

$$\begin{array}{cc}\hfill x_{k+1}& =x_k+{\alpha }_k{p}_k,\hfill \\ \hfill p_k& =\left\{\begin{array}{cc}-g_k,\hfill & k=1\hfill \\ -g_k+{\beta }_k{p}_{k-1},\hfill & k⩾2\hfill \end{array}\right.\hfill \end{array}$$

(9)

where $g_k=\nabla f\left(x_k\right),p_k$ is the search direction, ${\alpha }_k>0$ is the step factor, ${\beta }_k$ is a certain parameter, and different ${\beta }_k$ corresponds to a different CG method. That is, when $f(x)$ is a strictly convex quadratic function, the search direction p generated by the method (9) is conjugated to the Hessian matrix of $f(x)$. The process of CG iteration is described in Algorithm 1, where ${\mathit{r}}_i$ is the residual vector, ${\mathit{p}}_i$ is the search direction, ${\mathit{x}}_i$ is the approximate solution. In addition, ${\alpha }_i$ and ${\beta }_i$ are the step factors, and the stopping criterion is that the algorithm achieves convergence.

Algorithm 1 The conjugate gradient (CG) algorithm.

Input: Given symmetric positive definite matrix $\mathbf{A}$; Given the vector $\mathit{b}$; Given the initial iteration value $\mathit{x}$; Initialization: ${\mathit{r}}_0=\mathit{b}-\mathbf{A}{\mathit{x}}_0$; ${\mathit{p}}_0={\mathit{r}}_0$; repeat    for$k=0,1,\dots$do       if${\mathit{p}}_k=0$then          return ${\mathit{x}}_0$;       endelse          ${\alpha }_k=\frac{{\mathit{r}}_k^{\mathrm{T}}{\mathit{r}}_k}{{\mathit{p}}_k^{\mathrm{T}}\mathbf{A}{\mathit{p}}_k}$;          ${\mathit{x}}_{k+1}={\mathit{x}}_k+{\alpha }_k{\mathit{p}}_k$;          ${\mathit{r}}_{k+1}={\mathit{r}}_k-{\alpha }_k\mathbf{A}{\mathit{p}}_k$;          ${\beta }_k=\frac{{\mathit{r}}_{k+1}^{\mathrm{T}}{\mathit{r}}_{k+1}}{{\mathit{r}}_k^{\mathrm{T}}{\mathit{r}}_k}$;          ${\mathit{p}}_{k+1}={\mathit{r}}_{k+1}+{\beta }_k{\mathit{p}}_k$;       end    end until Stopping_Criterion is met.

In order to address the nonlinear problem effectively, the KCG algorithm was proposed for online application [11]. In an effort to use kernel techniques, the solution vector of the algorithm CG is represented by a linear combination of input vectors. Then, the convergence speed of the online algorithm KCG is much faster than that of the algorithm KLMS. Actually, the KCG achieves the same convergence performance as the KRLS in many cases; however, the computational cost is greatly reduced [11]. Another attractive feature of KCG is that it does not require the user-defined parameters. The algorithm KCG is described as Algorithm  2. In this algorithm, $\mathbf{G}$ is the Gram matrix, $\mathit{\eta }$ is the coefficient vector, $\kappa (·,·)$ is the Mercer kernel, M is the size of the dictionary, ${\mathit{r}}_0$ and ${\mathit{r}}_1$ are the residual vectors, and $\mathit{e}$ is the error vector. Moreover, ${\alpha }_1$, ${\alpha }_2$, and ${\beta }_2$ are step sizes; ${\mathit{S}}_1$ is the residual vector of the normal equation; ${\mathit{v}}_1$ and ${\mathit{v}}_2$ are intermediate vectors; and $\mathrm{H}$ stands for the conjugate transpose.

Algorithm 2 The kernel conjugate gradient (KCG) algorithm.

Initialization: ${\mathbf{X}}_1={\mathit{x}}_1;q_1=\kappa ({\mathit{x}}_1,{\mathit{x}}_1);{\mathit{q}}_1=\left[\sqrt{q_1}\right]$; ${\mathbf{G}}_1=q_1;{\mathit{\eta }}_1=\frac{{\overline{\mathit{d}}}_1}{q_1};{\mathit{e}}_1=0;M=1$; repeat    for$k=2,3,\dots$do       $q_k=\kappa ({\mathit{x}}_k,{\mathit{x}}_k)$;       ${\mathit{g}}_k=\left[\kappa \left({\mathbf{X}}_M(:,1),{\mathit{x}}_k\right),\dots ,\kappa \left({\mathbf{X}}_M(:,M),{\mathit{x}}_k\right)\right]$;       ${\nu }_m=\frac{{\mathit{g}}_k(m)}{\sqrt{q_k}{\mathit{q}}_{k-1}(m)};(m=1,2,\dots ,M)$       if$max\left\{\left|{\nu }_m\right|\right\}<{\nu }_0$then          $M=M+1$;          ${\mathbf{X}}_M=\left[{\mathbf{X}}_{M-1},{\mathit{x}}_k\right];{\mathit{q}}_M=\left[{\mathit{q}}_{M-1},\sqrt{q_k}\right]$;          ${\mathbf{G}}_M=\left[\begin{array}{cc}{\mathbf{G}}_{M-1}\hfill & {\mathit{g}}_k^{\mathrm{T}}\hfill \\ {\overline{\mathit{g}}}_k\hfill & q_k\hfill \end{array}\right]$;          ${\mathit{r}}_0={\left[{\mathit{e}}_{M-1},{\mathit{d}}_k-{\mathit{g}}_k{\overline{\mathit{\eta }}}_{M-1}\right]}^{\mathrm{H}};{\mathit{v}}_1={\mathbf{G}}_M{\mathit{r}}_0$;          ${\gamma }_0=〈{\mathit{v}}_1,{\mathit{r}}_0〉;{\alpha }_1=\frac{{\gamma }_0}{〈{\mathit{v}}_1,{\mathit{v}}_1〉}$;          ${\mathit{r}}_1={\mathit{r}}_0-{\alpha }_1{\mathit{v}}_1;{\mathit{s}}_1={\mathbf{G}}_M{\mathit{r}}_1$;          ${\gamma }_1=〈{\mathit{s}}_1,{\mathit{r}}_1〉;{\beta }_2=\frac{{\gamma }_1}{{\gamma }_0}$;          ${\mathit{v}}_2={\beta }_2{\mathit{v}}_1+{\mathit{s}}_1;{\alpha }_2=\frac{{\gamma }_1}{〈{\mathit{v}}_2,{\mathit{v}}_2〉}$;          ${\mathit{\eta }}_M=\left[{\mathit{\eta }}_{M-1},0\right]+\left({\alpha }_1+{\alpha }_2{\beta }_2\right){\mathit{r}}_0+{\alpha }_2{\mathit{r}}_1$;          ${\mathit{e}}_M={\left({\mathit{r}}_1-{\alpha }_2{\mathit{v}}_2\right)}^{\mathrm{H}}$;       end    end until Stopping_Criterion is met.

Since the algorithm KCG is derived from the solution of the least squares problem, good performance can be maintained in a Gaussian noise environment [11]. However, in the non-Gaussian case, the performance of KCG may not be satisfactory [11]. Therefore, we used the mixture correntropy as the loss function and propose the algorithm KMCCG.

2.3. Sparsification Criterion

KAF uses an online approaching strategy, that is each time a new set of data arrives, it is allocated a storage unit. The linear growth of the network structure leads to an increase in the memory requirements and calculations of KAF. Since the angle between two elements in the feature space can be represented by the inner product and the similarity of the elements in the space can be measured by an angle, then a simple sparsification criterion on the basis of the angle between elements in RKHS is used to control the network structure [11]. The cosine of the angle between $\phi (\mathit{x})$ and $\phi (\mathit{y})$ is as follows:

$$\nu (\mathit{x},\mathit{y})=\frac{\langle \phi (\mathit{x}),\phi (\mathit{y})\rangle }{\parallel \phi (\mathit{x})\parallel ·\parallel \phi (\mathit{y})\parallel }=\frac{\kappa (\mathit{y},\mathit{x})}{\sqrt{\kappa (\mathit{x},\mathit{x})\kappa (\mathit{y},\mathit{y})}}.$$

(10)

The algorithm reconstructs the network “dictionary” through the sparsification criterion. If the current dictionary is D and a new sample $({\mathit{x}}_k,{\mathit{d}}_k)$ is coming, the procedure of the angle criterion-based sparsification can be described through the following two steps.

First, the parameter v is calculated:

$${\nu }_k=\underset{1⩽m⩽M}{max}\left|\nu \left({\mathit{x}}_k,{\tilde{\mathit{x}}}_m\right)\right|\in [0,1].$$

(11)

Second, if ${\nu }_k$ is smaller than the predefined threshold ${\nu }_0$, $\left(\phi \left({\mathit{x}}_k\right),{\mathit{d}}_k\right)$ is added to D, otherwise it is discarded. Because the parameter ${\nu }_0$ represents the level of similarity between the new element and those old elements in D, we call it the similarity parameter.

3. The Proposed Algorithm

3.1. Half-Quadratic Optimization of the Mixture Correntropy

For the mixture correntropy loss function (5), since its Hessian matrix is not positive definite, its global convexity cannot be guaranteed. Therefore, the mixture correntropy loss cannot be directly applied to the convex optimization problem. Fortunately, the half-quadratic (HQ) optimization method is an effective method to address the non-convex optimization problem [33], which converts the original objective function into the half-quadratic objective function. In this article, the HQ optimization method is used to transform the mixture correntropy loss function, and then, the method CG is employed to solve the transformation function.

Since the mixture correntropy is the sum of two exponential functions, we let $f(x)=exp(-x)$ be an exponential function. The conjugate function of $f(x)$ is $g(v)=-vln(-v)+v(v<0)$. According to the theory of the conjugate function, the conjugate function of $g(v)$ is given by:

$$g^{*}(u)=\underset{v<0}{sup}\{uv-g(v)\}=\underset{v<0}{sup}\{uv+vln(-v)-v\}.$$

(12)

Let $f(v)=uv+vln(-v)-v$, where $v<0$. Then, $f(v)$ reaches the maximum value $exp(-u)$ at $v=-exp(-u)$. Therefore, we can get:

$$g^{*}(u)=\underset{v<0}{sup}\{uv+vln(-v)-v\}=exp(-u),$$

(13)

where $v=-exp(-u)$.

When $u=\frac{e_k^2}{2{\sigma }^2}$, we can get:

$$g^{*}\left(\frac{e_k^2}{2{\sigma }^2}\right)=\underset{v<0}{sup}\left\{v\frac{e_k^2}{2{\sigma }^2}+vln(-v)-v\right\}=exp\left(-\frac{e_k^2}{2{\sigma }^2}\right),$$

(14)

where $v=-exp\left(-\frac{e_k^2}{2{\sigma }^2}\right)$.

Then, (5) can be written as:

$$\begin{array}{cc}\hfill M(X,Y)& =\frac{\alpha }{N}\sum _{i=1}^N{\kappa }_{{\sigma }_1}\left(x_i,y_i\right)+\frac{1-\alpha }{N}\sum _{i=1}^N{\kappa }_{{\sigma }_2}\left(x_i,y_i\right)\hfill \\ & =\frac{\alpha }{N}\sum _{i=1}^{N}exp\left(-\frac{e_i^2}{2{\sigma }_1^2}\right)+\frac{1-\alpha }{N}\sum _{i=1}^{N}exp\left(-\frac{e_i^2}{2{\sigma }_2^2}\right)\hfill \\ & =\frac{\alpha }{N}\underset{v<0}{sup}\left\{v_i\frac{e_k^2}{2{\sigma }_1^2}-g(v_i)\right\}+\frac{1-\alpha }{N}\underset{v^{\prime }<0}{sup}\left\{v_i^{\prime }\frac{e_k^2}{2{\sigma }_2^2}-g(v_i^{\prime })\right\}.\hfill \end{array}$$

(15)

Because the solution to the mixture correntropy Loss (6) is equivalent to solving the following problem:

$$\begin{array}{cc}\hfill \underset{v<0}{max}M(X,Y)& =\frac{\alpha }{N}\underset{v<0}{max}\left\{v_i\frac{e_k^2}{2{\sigma }_1^2}-g(v_i)\right\}+\frac{1-\alpha }{N}\underset{v^{\prime }<0}{max}\left\{v_i^{\prime }\frac{e_k^2}{2{\sigma }_2^2}-g(v_i^{\prime })\right\},\hfill \end{array}$$

(16)

therefore, by solving the sum of the following weighted least squares problems, the equivalent solution of the mixture correntropy can be obtained.

$$\frac{\alpha }{N}min\sum _{i=1}^N\left(-v_i\frac{e_i^2}{2{\sigma }_1^2}\right)+\frac{1-\alpha }{N}min\sum _{i=1}^N\left(v_i^{\prime }-\frac{e_i^2}{2{\sigma }_2^2}\right),$$

(17)

where $v_i=-exp\left(-\frac{e_i^2}{2{\sigma }_1^2}\right)$, $v_i^{\prime }=-exp\left(-\frac{e_i^2}{2{\sigma }_2^2}\right)$, $e_i=y_i-f(x_i)$.

The Hessian matrix of the weighted least squares problem (17) is as follows:

$$\mathbf{H}(\mathit{e})=diag\left[-\frac{\alpha v_1}{{\sigma }_1^2},-\frac{\alpha v_2}{{\sigma }_1^2},\dots ,-\frac{\alpha v_N}{{\sigma }_1^2}\right]+diag\left[-\frac{(1-\alpha )v_1^{\prime }}{{\sigma }_2^2},-\frac{(1-\alpha )v_2^{\prime }}{{\sigma }_2^2},\dots ,-\frac{(1-\alpha )v_N^{\prime }}{{\sigma }_2^2}\right],$$

(18)

where $v_i<0$ and $v_i^{\prime }<0$. Hence, we obtain $\mathbf{H}(\mathit{e})>0$, and then, (17) is a global convex optimization problem. Here, when the Hessian matrix is positive definite, it means that the function is a convex function. Then, the objective function can be optimized by the conjugated gradient method.

3.2. Kernel Mixture Correntropy Conjugate Gradient Algorithm

The core of KAF is to transform the input data into a high-dimensional feature space through the kernel function. The inner product operation in the feature space is more efficiently calculated by the kernel technique. Its goal is to get the mapping function $f(x)$ between the input and output. According to the adaptive filtering theory, we can obtain:

$$f({\mathit{x}}_k)=\sum _{i=1}^k{\eta }_i\kappa \left(·,{\mathit{x}}_k\right),$$

(19)

where ${\eta }_i$ is the expansion coefficient and $\kappa \left(·,{\mathit{x}}_k\right)$ is a kernel function with the center ${\mathit{x}}_k$.

According to (17), we consider the following kernel-induced weighted least squares problem:

$$\begin{array}{c}\hfill \begin{array}{cc}& \frac{\alpha }{N}min\sum _{i=1}^k\left(-\frac{v_i}{2{\sigma }_1^2}{\left(d_i-{\eta }_i\kappa \left(·,{\mathit{x}}_k\right)\right)}^2\right)+\frac{1-\alpha }{N}min\sum _{i=1}^k\left(-\frac{v_i^{\prime }}{2{\sigma }_2^2}{\left(d_i-{\eta }_i\kappa \left(·,{\mathit{x}}_k\right)\right)}^2\right)\hfill \\ \hfill =& \frac{\alpha }{N}min{∥\sqrt{\mathbf{V}}\left({\mathit{d}}^{\mathrm{T}}-{\mathbf{G}}_1\mathit{\eta }\right)∥}^2+\frac{1-\alpha }{N}min{∥\sqrt{{\mathbf{V}}^{\prime }}\left({\mathit{d}}^{\mathrm{T}}-{\mathbf{G}}_2\mathit{\eta }\right)∥}^2,\hfill \end{array}\end{array}$$

(20)

where $\mathit{\eta }={[{\eta }_1,{\eta }_2,\dots ,{\eta }_k]}^{\mathrm{T}}$ is the expansion coefficient and $\mathbf{G}$ is the Gram matrix, which is defined as:

$${\mathbf{G}}_k=\left[\begin{array}{cccc}\kappa \left({\mathit{x}}_1,{\mathit{x}}_1\right)& \kappa \left({\mathit{x}}_1,{\mathit{x}}_2\right)& \cdots & \kappa \left({\mathit{x}}_1,{\mathit{x}}_k\right)\\ \kappa \left({\mathit{x}}_2,{\mathit{x}}_1\right)& \kappa \left({\mathit{x}}_2,{\mathit{x}}_2\right)& \cdots & \kappa \left({\mathit{x}}_2,{\mathit{x}}_k\right)\\ ⋮& ⋮& \ddots & ⋮\\ \kappa \left({\mathit{x}}_k,{\mathit{x}}_1\right)& \kappa \left({\mathit{x}}_k,{\mathit{x}}_2\right)& \cdots & \kappa \left({\mathit{x}}_k,{\mathit{x}}_k\right)\end{array}\right].$$

(21)

Then, we use the method CG to solve the weighted least squares problem (20). The major work of the online algorithm KMCCG lies in the update of the Gram matrix ${\mathbf{G}}_M$ and the coefficient vector ${\mathit{\eta }}_M$. The Gram matrix ${\mathbf{G}}_M$ can be updated as follows:

$${\mathbf{G}}_M=\left[\begin{array}{cc}{\mathbf{G}}_{M-1}& {\mathit{g}}_M^{\mathrm{T}}\\ {\overline{\mathit{g}}}_M& q_M\end{array}\right],$$

(22)

where $q_M=\kappa \left({\mathit{x}}_M,{\mathit{x}}_M\right)$ and ${\mathit{g}}_M=\left[\kappa \left({\mathit{x}}_1,{\mathit{x}}_M\right),\kappa \left({\mathit{x}}_2,{\mathit{x}}_M\right),\dots ,\kappa \left({\mathit{x}}_{M-1},{\mathit{x}}_M\right)\right]$. Because ${\left[{\mathit{\eta }}_{M-1},0\right]}^{\mathrm{T}}$ is a good approximation of ${\mathit{\eta }}_M$, only a few iterations (one or two) with this initial vector can achieve satisfactory performance. We use ${\left[{\mathit{\eta }}_{M-1},0\right]}^{\mathrm{T}}$ as the initial value of ${\mathit{\eta }}_M$, and the initial residual ${\mathit{r}}_0$ can be expressed as follows:

$$\begin{array}{cc}\hfill {\mathit{r}}_0& =\alpha {\mathbf{V}}_k\left({\mathit{d}}^{\mathrm{T}}-{\mathbf{G}}_k{\left[{\mathit{\eta }}_{M-1},0\right]}^{\mathrm{T}}\right)+(1-\alpha ){\mathbf{V}}_k^{\prime }\left({\mathit{d}}^{\mathrm{T}}-{\mathbf{G}}_k{\left[{\mathit{\eta }}_{M-1},0\right]}^{\mathrm{T}}\right)\hfill \\ & =\alpha {\mathbf{V}}_k\left(\left[\begin{array}{c}{\mathit{d}}_{k-1}^{\mathrm{T}}\\ d_k\end{array}\right]-\left[\begin{array}{cc}{\mathbf{G}}_{k-1}& {\mathit{g}}_k^{\mathrm{T}}\\ {\overline{\mathit{g}}}_k& q_k\end{array}\right]\left[\begin{array}{c}{\mathit{\eta }}_{k-1}\\ 0\end{array}\right]\right)+(1-\alpha ){\mathbf{V}}_k^{\prime }\left(\left[\begin{array}{c}{\mathit{d}}_{k-1}^{\mathrm{T}}\\ d_k\end{array}\right]-\left[\begin{array}{cc}{\mathbf{G}}_{k-1}& {\mathit{g}}_k^{\mathrm{T}}\\ {\overline{\mathit{g}}}_k& q_k\end{array}\right]\left[\begin{array}{c}{\mathit{\eta }}_{k-1}\\ 0\end{array}\right]\right)\hfill \\ & =\alpha {\left[{\mathit{e}}_{k-1},v_k\left(d_k-{\overline{\mathit{g}}}_k{\mathit{\eta }}_{k-1}\right)\right]}^{\mathrm{T}}+(1-\alpha ){\left[{\mathit{e}}_{k-1},v_k^{\prime }\left(d_k-{\overline{\mathit{g}}}_k{\mathit{\eta }}_{k-1}\right)\right]}^{\mathrm{T}}\hfill \\ & =\alpha {\left[{\mathit{e}}_{k-1},v_k{e}_k\right]}^{\mathrm{T}}+(1-\alpha ){\left[{\mathit{e}}_{k-1},v_k^{\prime }{e}_k\right]}^{\mathrm{T}},\hfill \end{array}$$

(23)

where ${\mathbf{V}}_k=\left[\begin{array}{cc}\mathbf{I}& \mathbf{0}\\ {\mathbf{0}}^{\mathrm{T}}& v_k\end{array}\right]$, ${\mathbf{V}}_k^{\prime }=\left[\begin{array}{cc}\mathbf{I}& \mathbf{0}\\ {\mathbf{0}}^{\mathrm{T}}& v_k^{\prime }\end{array}\right]$, $v_k=\frac{1}{{\sigma }^2}exp\left(-\frac{e_k^2}{2{\sigma }_1^2}\right)$, and $v_k^{\prime }=\frac{1}{{\sigma }^2}exp\left(-\frac{e_k^2}{2{\sigma }_2^2}\right)$. Then, we can get the KMCCG, as shown in Algorithm 3.

What follows is a working example we provide for this section to show the evolution of values throughout the whole process. Let ${\mathit{x}}_1=[0,0,0,0,1.0399]$, ${\mathit{d}}_1=[1.5700]$, ${\mathit{x}}_2=[0,0,0,1.0399,1.5700]$, and ${\mathit{d}}_2=[1.3156]$. Then, according to Algorithm 3, the evolution of the values is as follows.

When $k=2$, $q_2=\kappa \left(x_2,x_2\right)=0.6595$, ${\mathit{g}}_2=\kappa \left({\mathit{x}}_1,{\mathit{x}}_2\right)=0.3337$, and $v_1=0.3337$, then because $max\left\{\left|v_1\right|\right\}<v_0=0.8$, ${\mathit{x}}_2$ is added to the dictionary, which means that $M=M+1=2$ and ${\mathbf{X}}_2=\left[{\mathbf{X}}_1,{\mathit{x}}_2\right]$. The Gram matrix ${\mathbf{G}}_M$ can be updated as follows:

$${\mathbf{G}}_2=\left[\begin{array}{cc}{\mathbf{G}}_1& {\mathit{g}}_2^{\mathrm{T}}\\ {\overline{\mathit{g}}}_2& q_2\end{array}\right].$$

(24)

Then, the residual can be obtained as ${\mathit{r}}_0={[0,0.3991]}^{\mathrm{T}}$ and ${\mathit{r}}_1={[-0.1834,0.1210]}^{\mathrm{T}}$. On the basis of this, the correlation coefficient ${\mathit{\eta }}_2$ can be updated. When the new input arrives, the algorithm will continuously update the correlation coefficient to make it more suitable for the next input. Finally, the algorithm will stop when the convergence condition is satisfied, that is it reaches the maximum number of iterations.

Algorithm 3 The kernel mixture correntropy conjugate gradient (KMCCG) algorithm.

Initialization: ${\mathbf{X}}_1={\mathit{x}}_1;q_1=\kappa \left({\mathit{x}}_1,{\mathit{x}}_1\right);{\mathit{q}}_1=\left[\sqrt{q_1}\right]$; ${\mathbf{G}}_1=q_1;{\mathit{\eta }}_1=\frac{{\overline{\mathit{d}}}_1}{q_1};{\mathit{e}}_1=0;M=1$; repeat    for$k=2,3,\dots$do       $q_k=\kappa \left({\mathit{x}}_k,{\mathit{x}}_k\right)$;       ${\mathit{g}}_k=\left[\kappa \left({\mathbf{X}}_M(:,1),{\mathit{x}}_k\right),\dots ,\kappa \left({\mathbf{X}}_M(:,M),{\mathit{x}}_k\right)\right]$;       ${\nu }_m=\frac{{\mathit{g}}_k(m)}{\left[\sqrt{q_k}{\mathit{q}}_{k-1}(m)\right]};(m=1,2,\dots ,M)$       if$max\left\{\left|{\nu }_m\right|\right\}<{\nu }_0$then          $M=M+1$;          ${\mathbf{X}}_M=\left[{\mathbf{X}}_{M-1},{\mathit{x}}_k\right];{\mathit{q}}_M=\left[{\mathit{q}}_{M-1},\sqrt{q_k}\right]$;          ${\mathbf{G}}_M=\left[\begin{array}{cc}{\mathbf{G}}_{M-1}\hfill & {\mathit{g}}_k^{\mathrm{T}}\hfill \\ {\overline{\mathit{g}}}_k\hfill & q_k\hfill \end{array}\right]$;          $e_k=d_k-{\overline{\mathit{g}}}_k{\mathit{\eta }}_{k-1}$;          $v_k=\frac{1}{{\sigma }_1^2}·exp\left(-\frac{e_k^2}{2{\sigma }_1^2}\right);v_k^{\prime }=\frac{1}{{\sigma }_2^2}·exp\left(-\frac{e_k^2}{2{\sigma }_2^2}\right)$;          ${\mathit{r}}_0=\alpha {\left[{\mathit{e}}_{k-1},v_k{e}_k\right]}^{\mathrm{T}}+(1-\alpha ){\left[{\mathit{e}}_{k-1},v_k^{\prime }{e}_k\right]}^{\mathrm{T}};{\mathit{v}}_1={\mathbf{G}}_M{\mathit{r}}_0$;          ${\gamma }_0=〈{\mathit{v}}_1,{\mathit{r}}_0〉;{\alpha }_1=\frac{{\gamma }_0}{〈{\mathit{v}}_1,{\mathit{v}}_1〉}$;          ${\mathit{r}}_1={\mathit{r}}_0-{\alpha }_1{\mathit{v}}_1;{\mathit{s}}_1={\mathbf{G}}_M{\mathit{r}}_1$;          ${\gamma }_1=〈{\mathit{s}}_1,{\mathit{r}}_1〉;{\beta }_2=\frac{{\gamma }_1}{{\gamma }_0}$;          ${\mathit{v}}_2={\beta }_2{\mathit{v}}_1+{\mathit{s}}_1;{\alpha }_2=\frac{{\gamma }_1}{〈{\mathit{v}}_2,{\mathit{v}}_2〉}$;          ${\mathit{\eta }}_M=\left[{\mathit{\eta }}_{M-1},0\right]+\left({\alpha }_1+{\alpha }_2{\beta }_2\right){\mathit{r}}_0+{\alpha }_2{\mathit{r}}_1$;          ${\mathit{e}}_M={\left({\mathit{r}}_1-{\alpha }_2{\mathit{v}}_2\right)}^{\mathrm{H}}$;       end    end until Stopping_Criterion is met.

3.3. Computational Time Complexity Analysis

As shown in

Table 1. Computational cost for dictionary update. KLMS (kernel least mean squares); KRLS (kernel recursive least squares); KCG (kernel conjugate gradient); KMCCG (kernel mixture correntropy conjugate gradient).

Algorithm	Additions	Multiplications	Divisions
KLMS	$\mathrm{M}$	$\mathrm{M}$	0
KRLS	$4{\mathrm{M}}^2+4\mathrm{M}$	$4{\mathrm{M}}^2+4\mathrm{M}$	1
KCG	$2{\mathrm{M}}^2+8\mathrm{M}$	$2{\mathrm{M}}^2+10\mathrm{M}$	3
KMCCG	$2{\mathrm{M}}^2+8\mathrm{M}+1$	$2{\mathrm{M}}^2+10\mathrm{M}+2$	5

, we obtain the computational time complexity of four algorithms KLMS, KRLS, KCG, and KMCCG, after analyzing the implementation process of those algorithms. In this table, $\mathrm{M}$ is the dictionary size in the algorithm. KLMS is a simple KAF with minimal computational complexity. KRLS requires $(4{\mathrm{M}}^2+4\mathrm{M})$ additions, $(4{\mathrm{M}}^2+4\mathrm{M})$ multiplications, and one division per iteration, while KCG achieves a convergence speed and filtering accuracy comparable to KRLS [11], and its computational complexity is relatively small. In addition, compared with KCG, KMCCG requires two divisions and one multiplication when calculating $v_k$ and also requires an addition and a multiplication to update the residual vector ${\mathit{r}}_0$. Table 1 shows that in each iteration, KMCCG requires fewer additions and multiplications than KRLS, but requires four more division operations. Because the number of instruction cycles required by the division operation is generally 20-times that of the addition operation and $\mathrm{M}$ is usually greater than 100, the computational complexity of KMCCG is still lower than that of the KRLS algorithm. Moreover, when the input vector does not meet the sparsification criterion, there is no additional calculation for KMCCG, but there are still $(4{\mathrm{M}}^2+4\mathrm{M})$ additions and $(4{\mathrm{M}}^2+4\mathrm{M})$ multiplications for KRLS. Therefore, KMCCG can achieve higher prediction accuracy with less computational and storage costs.

4. Experimental Results and Discussions

In this section, the experiments on short-term predictions of the Mackey–Glass chaotic time series, minimum daily temperatures time series, and the real-world malware API call sequence are conducted to illustrate the performance of our proposed algorithm.

4.1. Mackey–Glass Time Series Prediction

The chaotic time series is one of the fundamental forms of movement in nature and human society. Generally, the classical Mackey–Glass chaotic time series is generated by the following differential equation [6]:

$$\frac{dx(t)}{dt}=-bx(t)+\frac{ax(t-\tau )}{1+x{(t-\tau )}^n},$$

(25)

where the parameters are set to $a=0.2,b=0.1,n=10$, and $\tau =30$. Moreover, the sampling period is 6 s. This experiment uses the past seven samples $\mathit{u}(k)=\left[x(k),x(k-1),\dots ,x(k-6)\right]$ to predict the current input $\mathit{d}(k)=x(k+1)$. Then, we use the dimensions of the matrix to represent the size of the matrix. Therefore, the size of the training input set is ($7\times 1000$), the size of the training target set is ($1000\times 1$), the size of the testing input set is ($7\times 200$), and the size of the testing target set is ($200\times 1$).

The algorithm KMCCG was compared with the quantized KLMS (QKLMS) algorithm [34], the quantized kernel maximum correntropy (QKMC) algorithm [35], and the kernel maximum mixture correntropy (KMMCC) algorithm [15] in four different noise environments, to verify the performance of our proposed algorithm. Here, QKLMS is one of the most classical KAF algorithms based on the mean square error (MSE) criterion, and it achieves good prediction accuracy in the Gaussian noise environment. QKMC is a KAF algorithm based on correntropy, which can also achieve good prediction accuracy and maintain robustness. The recently-proposed algorithm KMMCC combined with the mixture correntropy criterion has been demonstrated to be able to obtain satisfactory prediction accuracy and robustness. All algorithms were configured with a Gaussian kernel. For a fair comparison, the optimal parameter setting was conducted to let each algorithm achieve the desirable performance. Finally, the performance of the algorithm was evaluated by MSE, which is defined here as follows:

$$\mathrm{MSE}=10{log}_{10}\left(\frac{1}{N}\sum _{i=1}^N{(d(i)-y(i))}^2\right),$$

(26)

where N represents the number of predicted values.

Figure 1 shows the learning performance of these algorithms in four noise environments. Obviously, in all four types of noise environments, the testing MSE of KMCCG was smaller than that of the stochastic gradient-based filtering algorithms, i.e., QKLMS, QKMC, and KMMCC. Meanwhile, the convergence speed of KMCCG was obviously faster than that of the other compared algorithms. This verifies that the CG technique used in KMCCG can achieve a faster convergence speed and higher learning accuracy. Therefore, the algorithm KMCCG can achieve the best performance in all the compared algorithms.

4.2. Minimum Daily Temperatures Time Series Prediction

In this section, the minimum daily temperatures time series is selected as the dataset to verify the performance of the proposed algorithm. This dataset describes the minimum daily temperature in Melbourne, Australia, for 10 years (1981–1990) [36]. The unit is Celsius, and there are 3650 observations. The data source is the Australian Meteorological Agency.

Here, we use the previous five input samples $\mathit{x}(k)={[x(k-5),x(k-4),\dots ,x(k-1)]}^{\mathrm{T}}$ to predict the current point $\mathit{d}(k)=x(k)$, where $\mathit{x}(k)$ and $\mathit{d}(k)$ represent the input vector and the corresponding expected output, respectively. Additionally, the size of the training input set as (5×1000); the size of the training target set was (1000×1); the size of the test input set was (5×200); and the size of the test target set was (200×1). Finally, the MSE was also used to evaluate the performance of those algorithms. Then, our algorithms was compared with QKLMS, QKMC, and KMMCC to verify the computational performance.

Figure 2 shows the learning curve for these algorithms. Obviously, the testing MSE of KMCCG is less than that of QKLMS, QKMC, and KMMCC, which demonstrates that the proposed algorithm can perform better than all three other algorithms.

4.3. Malware API Call Sequence Prediction

In this section, We apply the proposed algorithm to the malware API call sequence prediction, while verifying the effectiveness of our algorithm through the actual time series data. The purpose of this experiment is to predict what the next API would be, which can be used to determine whether it is malware or not.

4.3.1. Background

API is the service interface provided by the operating system. Applications call the API when completing file reading and writing, network access, and other tasks [37]. Meanwhile, malware also needs to call the API when implementing functions. Hence, it is an effective method to predict and detect malware behavior by extracting the API call sequence [21].

With the rapid advances in computational intelligence methodology, using machine learning algorithms to predict malware via the API call sequence can make the malware prediction more intelligent, and the new malware can be detected in a more timely manner [38]. In this field, SVM, ANN, and other methods have been applied to malware prediction and detection, and some satisfactory results are achieved.

In [39], with the help of global features using the Gabor wavelet transform and Gist, the feed-forward ANN was developed to identify the behavior of malicious data with a good accuracy. In [40], after abstracting the complex behaviors based on the semantic analysis of dynamic API sequences, an SVM was proposed to achieve malware detection with good generalization ability. Furthermore, with the popular use of the deep learning method, some DNN models were also applied to tackle the issue of malware detection. For instance, in [41], the features were extracted from five minutes of API call log sequences by using a recurrent neural network, and then, they were input to the convolutional neural network to achieve deep learning with the purpose of malware detection.

Although some good performances have been achieved by using the above approaches, there still exist several limitations, such as the long training time and difficulty in parameter determination. Since mixture correntropy as a new measure of local similarity defined in kernel space can be used to address large outliers, hence, in order to reduce the training time while maintaining high prediction accuracy and robustness to abnormal data in the API call sequence, our algorithm KMCCG can be considered to cope with the malware prediction. Here, it should be noted that although some traditional machine learning-based malware prediction and detection algorithms may be vulnerable to adversarial methods or tools, such as EvadeML [42] and poisoning attack [43], the algorithm KMCCG may be a better choice in malware prediction, in consideration of the satisfactory robustness achieved by using mixture correntropy.

We mainly analyzed the acquired API call sequence and predicted the malicious behavior that may occur in the future using our proposed kernel learning algorithm. Then, through the combination of these predicted malicious behaviors with the actual detected malicious behaviors, we will extract feature vectors and integrate them as the discriminant basis of malware detection. In so doing, we can determine whether the application belongs to malware or not, through the machine learning classification model.

4.3.2. Experimental Result

API call information can be extracted by static and dynamic methods. Through the use of the static method [44], the API list can be extracted from the portable executable (PE) format of the executable files. Furthermore, with the dynamic method [45], the called API can be observed by running the executable files.

While creating the dataset, we randomly selected Windows malware samples from the malware datasets of Dasmalwerk and VirusShare and put the software into the cuckoo sandbox to analyze the report automatically. In order to avoid related security issues caused by malware propagation and accidental execution, here we chose to deploy the cuckoo sandbox to the Ubuntu environment. Figure 3 shows a flowchart for building the malware corpus. The specific analysis process of the sample is as follows: (1) The first step is to launch cuckoo on the Linux platform. (2) Then, we submit the sample to be analyzed to cuckoo. (3) Cuckoo uploads the sample to the virtual machine and collects the behavior data. (4) After the analysis is completed, cuckoo will generate an analysis report in its own working directory. Then, the API sequence is extracted from the report, and Figure 4 shows some API call time series. Each line in this figure represents a malware API call time series. In the following experiment, the API call sequence of a certain malware sample is selected as the dataset.

This experiment used the past seven samples to predict the current input. The size of the training input set was ($7\times 1000$); the size of the training target set was ($1000\times 1$), the size of the testing input set was ($7\times 200$), and the size of testing target set was ($200\times 1$). Figure 5 is the time series dataset obtained by replacing the API call sequence with the word frequency for which the API appeared in the whole dataset. Figure 6 shows the normalized sequence shown in Figure 5.

In this experiment, the performance of the algorithm is verified by comparing the prediction accuracy of QKLMS, KMMCC, ANN, SVM, and KMCCG. Considering that the prediction error is an effective evaluation metric, we still adopted the transformed error (26) to evaluate the algorithm performance. Figure 7 shows the learning performance of all five algorithms, which represents the relationship between the testing MSE of the algorithm and the number of iterations. Obviously, the MSE of KMCCG is smaller than that of the classical KAF algorithms, i.e., QKLMS and KMMCC. The total training time and the average value of MSE for five runs of the experiment are summarized in

Table 2. Computational results of QKLMS, KMMCC, ANN, SVM, and KMCCG in API call time series prediction.

Algorithm	Time (s)	MSE (dB)
QKLMS	39.03	−12.9139
KMMCC	52.46	−15.4081
ANN	841.41	−18.1565
SVM	106.21	−17.8825
KMCCG	2.24	−17.8421

. It can be found that the proposed algorithm can achieve a prediction accuracy equivalent to the popular ANN and SVM, but spent less training time. Here, the algorithm KMCCG can be successfully applied to predict malware API call sequences, which verifies the satisfactory performance of our proposed algorithm.

Then, the time series of malware API calls were combined with Gaussian noise to further verify the robustness of the algorithm. In the real world, noise is often not caused by a single source, but a combination of many different sources. As the number of noise sources increases, it tends to a Gaussian distribution. Here, Gaussian noise is considered in the experiment to analyze the impact of noise in the system. Figure 8 shows the performance comparison of the proposed algorithm with the other four algorithms in the Gaussian noise environment. The evaluation metric is also the MSE shown in (26). It can be seen that the algorithm KMCCG can achieve higher prediction accuracy and be more stable in the noise environment. This shows that KMCCG has satisfactory robustness.

5. Conclusions

Through the combination of the MCC and the algorithm KCG, a novel kernel learning algorithm, i.e., KMCCG, is proposed in this article. Specifically, in an effort to curb effectively the growing RBF network in our algorithm KMCCG, a sparsification criterion based on the angle between elements in RKHS is used to control the increase of data size in online applications, which is equivalent to the coherence criterion. The proposed algorithm achieves much faster convergence speed than the algorithm KLMS and lower computational complexity than the algorithm KRLS. The prediction results for Mackey–Glass chaotic time series and Lorentz time series showed that our algorithm achieved good performance in robustness, filtering accuracy, and computational efficiency. Furthermore, the proposed kernel learning algorithm was applied to malware prediction. The results also showed that the algorithm KMCCG not only had a short training time, but also maintained a high prediction accuracy, which further verified the satisfactory performance of KMCCG.

As a use case of our algorithm, this article only focused on the task of malware API call sequence prediction. Actually, the prediction experiment of malware API call time series is only a part of the malware detection technology, and the software cannot be directly classified as malware or a benign one by only using our method. In future work, we will combine the results of future behavior prediction with the actual detected malicious behavior as the basis of classification reference and judge whether the application belongs to malware or not. Moreover, to further extend the applications of malware prediction and detection while using the algorithm KMCCG, we will discuss some other classification tasks for malware through the evaluation of false positives.