# Plastic response by dislocation glide in solid helium under dc strain rate
loading

Caizhi Zhou1,2,3<EMAIL_ADDRESS>Jung-Jung Su4 Matthias J. Graf1 Charles
Reichhardt1 Alexander V. Balatsky1,5 Irene J. Beyerlein1 1Theoretical
Division, Los Alamos National Laboratory, Los Alamos, New Mexico 87545, USA
2Center for Nonlinear Studies, Los Alamos National Laboratory, Los Alamos, New
Mexico 87545, USA
3Dept. of Materials Science and Engineering, Missouri University of Science
and Technology, Rolla, MO 65409, USA
4Dept. of Electrophysics, National Chiao Tung University, Hsinchu 300, Taiwan
5Nordita, 23 Roslagstullbacken, Stockholm, Sweden

###### Abstract

We develop a model for the gliding of dislocations and plasticity in solid
4He. This model takes into account the Peierls barrier, multiplication and
interaction of dislocations, as well as classical thermally and mechanically
activated processes leading to dislocation glide. We specifically examine the
dc stress-strain curve and how it is affected by temperature, strain rate, and
dislocation density. As a function of temperature and shear strain, we observe
plastic deformation and discuss how this may be related to the experimental
observation of elastic anomalies in solid hcp 4He that have been discussed in
connection with the possibility of supersolidity or giant plasticity. Our
theory gives several predictions for the dc stress strain curves, for example,
the yield point and the change in the work-hardening rate and plastic
dissipation peak, that can be compared directly to constant strain rate
experiments and thus provide bounds on model parameters.

###### pacs:

61.72.Hh, 67.80.B-, 67.80.bd

##  I Introduction

Studies in solid 4He have recently received renewed interest due to the
observation of a period drop in torsional oscillator experiments.Chan04 ;
Rittner06 ; Kondo07 ; Aoki07 ; Penzev08 ; Hunt09 ; Pratt11  This drop was
interpreted as possible evidence for a supersolid phase. Subsequently, the
same system was shown to exhibit an anomalous softening of the shear modulus
with increasing temperature in the same temperature regime where the period
drop was observed. It suggested that the shear modulus change and the period
drop were connected and dislocations which contribute to the shear modulus
softening played an important role in the possible supersolid behavior.Day07 ;
Day09 ; West2009  One interpretation of how dislocation dynamics produce the
period drop anomaly is that the dislocations are not freely gliding but are
pinned at certain points while the unpinned portions vibrate, and that these
vibrations produce additional damping.Day07 ; Day09 ; Mukharsky2009 ;
Syshchenko10 ; Rojas11 ; West2009  More recently, there have been more precise
follow-up experiments on solid 4He in porous Vycor glass, where the period
drop in the torsional oscillator measurements was no longer observed,
DYKim2012  arguing against a supersolid scenario; however, a still open
question is what is responsible for the observed anomaly in the shear modulus.

Although the issue of supersolidity may be close to being settled, solid 4He
still presents interesting questions in terms of the mechanical response of
materials with dislocations, and may exhibit elastic-plastic properties that
are much more difficult to access in conventionally studied materials systems.
We propose that the possible cause for the change of elastic properties
measured in experiments is plastic deformation arising from the gliding motion
of dislocations. This is in contrast to the vibrating string model of
dislocations pinned by a network that do not show true (free) glide.Iwasa1979
; Paalanen1981 ; Hiki1983 ; Iwasa2010 ; Iwasa2013  The important questions are
whether the anomaly is caused by the free glide of dislocations, whether the
model is consistent with the observed experiments, and whether the model can
provide additional predictions. In our model, dislocation glide produces clear
signatures in dc stress-strain curves in solid 4He similar to the effects
established for other materials, such as dc stress-strain curves for metals
that are discussed in the literature.Mecking1981 ; Orowan1954 ; Friedel1967 ;
Nabarro1967 ; Hull2011

The study of dislocation motion and plastic deformation of crystals has a long
tradition and is typically analyzed by conducting dc stress-strain curves for
different strain rates and temperatures.Mecking1981 ; Essmann79 ; Beyerlein08
; Brown2012  Here we develop a dislocation dynamics model based on rate-
controlled mechanisms, where thermally-activated flow is assumed with basal or
prismatic slip in hcp crystals (like solid 4He at low temperatures). In
addition, the theory accounts for the creation and removal of dislocations as
well as their glide. Since mobile dislocations get pinned many times and at
many points along their length due to the interactions with other
dislocations, the effect of dislocation interaction must be included
explicitly. Finally, the rate of plastic strain is controlled by the rate at
which thermal and mechanical energy assist these segments to overcome their
energy barriers, allowing the rest of the dislocation line to bow out and
spread before it is stopped again. Hirsch1959 ; Friedel1963 ; Saada1963 ;
Seeger1963 ; Friedel1967 ; Nabarro1967 ; Kocks75

Many of the recent studies of the elastic properties of solid 4He were
performed with ac measurement techniques of alternating shear strain, where
the piezoelectric transducers were embedded in the solid helium. Here we focus
instead on dc drives where we can obtain clear predictions for the dislocation
glide, since under a dc drive the dislocations can move significant distances
in the sample. Under an ac drive, the dislocations may not glide very far and
it would be difficult to distinguish the smaller ac motion from the vibration
of a dislocation segment.

In the theory of plastic deformation of crystals, the role of dislocations
gliding in specific crystallographic directions on specific crystallographic
slip planes is related to a change of the work-hardening rate of the solid
with temperature and strain rate. Taylor1934 ; Orowan40 ; Wielke76 ; Kocks75 ;
Kocks03  The hypothesis that this microscopic picture of slip and propagation
of dislocations is relevant to solid helium received additional support from
recent experiments in the hcp phase of solid 4He. Fefferman2012  More recently
the reported low-temperature phenomena were interpreted as effects of giant
plasticity caused by gliding dislocations. Haziot2013a ; Haziot2013b
Naturally, the same mechanism may also be responsible for similar anomalous
behavior in disordered bcc crystals of 4He at temperatures close to the
melting line,Eyal12a ; Eyal12b  and in hcp 3He.West2009

In this paper, we develop a dislocation glide model for solid 4He that is
motivated by earlier work of Kocks and coworkers Kocks75 ; Mecking1981 ;
Kocks03  on the dynamics of mobile dislocations moving through a dislocation
forest. This model is based on the thermodynamics and kinetics of dislocation
glide to describe plastic deformation of crystals. However, we extend the
framework of this classical plasticity model by interpreting the zero-point
motion and quantum effects of solid helium as renormalization of potentials.
This will not qualitatively change the kinetics and dynamics, but instead
effectively renormalize certain thermodynamic quantities, such as by lowering
the pinning potential, Peierls barrier, or screening of the dislocation-
dislocation interaction.Kantha1994 ; Zaanen2004 ; Proville  In the case of the
dc shear strain rate experiment, $\dot{\epsilon}=const.$, with shear stress
$\tau$, we predict the softening of the work-hardening rate (WHR),
$d\tau/d\epsilon$, with increasing temperature $T$ due to dislocation glide
and the creation and multiplication of dislocation loops. Our dislocation
glide model also predicts that higher 3He impurity concentration in solid 4He
pushes the onset of the magnitude change in the WHR to higher temperatures by
assuming that more 3He atoms pin more dislocations. At the same time, the
zero-temperature value of the WHR is unaffected by immobile dislocations.
Finally, our calculations show that at zero temperature the WHR equals the
elastic shear modulus independent of applied strain, while at finite
temperature it decreases with increasing strain to a saturated value.Zhou12

We note that our theory is classical and the equations presented in section
IIA are classical. It may be possible that quantum effects would come into
play in our model, but they would only renormalize the parameters without
altering the equations. In this way, including quantum effects in our model is
consistent with the classical theory that describes classical solids as
discussed in the wide body of literature on plasticity in classical systems.

We account for thermal and quantum fluctuations in the thermodynamic part of
the model with renormalized phenomenological model parameters of the energy
barrier. A key result of this work is the prediction of a dissipation peak
caused by plastic deformation of the solid in the same temperature region
where the WHR changes most rapidly. The similarity of the dc strain rate model
predictions to existing shear measurements of applied ac strain rate is
remarkable, Day07 ; Day09 ; West2009 ; Syshchenko10 ; Rojas11  although a
direct comparison is not possible due to significantly different loading and
reverse-loading histories. Therefore, our results for the proposed dc strain
rate experiments will provide stringent tests for the study of the plastic
response of dislocation glide in the classical versus quantum regime at low
temperatures of solid 4He.

##  II Plastic glide of dislocations

Figure 1: (color online). Characteristic dislocation network in crystalline
materials illustrates the complexity of dislocation glide. (a) Snapshot of the
simulation of typical three-dimensional (3D) network of dislocations in
crystal. Different colors represent different Burgers vectors that indicate
the magnitude and direction of strain imparted by glide of the dislocations.
(b) Top view of 3D dislocation structure. Pinning points marked by arrows will
unzip from junctions under external loading; see the SM for details on the
simulation and the animation. SM

In crystalline materials like 4He, plastic deformation can arise from glide of
linear structural defects called dislocations. Dislocations are commonly found
in 4He crystal, even in the cleanest samples, Rojas11  due to the growth and
cooling processes. A typical dislocation structure similar to that in metals
is assumed in our model. In Fig. 1 we show a snapshot of the complexity of
such a three-dimensional (3D) dislocation network commonly studied in metals,
see the Supplemental Material (SM) SM  for details on the simulation and the
animation of the dislocation glide, as well as the unzipping of pinning points
marked by arrows. We borrow various elements from the seminal works on
evolution laws of thermally activated dislocation glide by Essmann and
Mughrabi,Essmann79  and Kocks and collaborators.Mecking1981 ; Kocks03  and
categorize the dislocations as being either stored or mobile. The stored
dislocations can assemble into networks inside individual crystals and do not
contribute to the plastic deformation. Hence an increase in pinned or stored
dislocations increases the WHR of the solid at higher temperatures. The mobile
dislocations, on the other hand, give rise to plastic strain and dissipation.
However they may not stay in their own category. When a mobile dislocation
glides through the network of stored dislocations it can be pinned and become
stored. This pinning can nevertheless be overcome by thermal activation and
applied strain and the dislocation then becomes mobile again.

###  II.1 Dislocation glide model

In our dislocation glide model, we adopt a statistical representation in which
individual dislocation characteristics (mobility, polarity, screw/edge
character, line orientation, and position) are not treated explicitly. Of
course, this is a great simplification of the complex problem of dislocations
and presents the first step toward capturing the essential mechanisms and
physics underlying dislocation glide in solid helium, similar to studies of
other materials in the past. For simplicity, the large network of dislocations
is represented as a continuous distribution of dislocation lines within a
representative volume, characterized by a dislocation density with units of
total dislocation line length per volume. The total dislocation density in a
material at time $t$ consists of both mobile and stored (immobile)
dislocations

$\displaystyle\rho_{tot}(t)=\rho_{mob}(t)+\rho_{stored}(t).$ (1)

In deformed crystals, stored dislocations assemble into networks within the
interior, as shown in Fig. 1. Here, we assume that stored dislocations take on
a similar three dimensional pattern in strained solid helium. Accordingly,
mobile dislocations moving in any direction and on any slip plane are likely
to become immobile, when they encounter a forest of stored dislocations
intersecting the glide plane, with which they strongly interact. When
dislocations glide, it was proposed that the total dislocation density
increases byTaylor1934 ; Orowan40 ; Kocks03

$\displaystyle\Delta\rho_{tot}(t)=\Delta\epsilon_{p}(t)/{\it b}L,$ (2)

per unit time $\Delta t$. Here $b$ is the magnitude of the Burgers vector, $L$
is the mean-free path of mobile dislocations in a forest of dislocations,
which is assumed to equal the interdislocation distance $1/\sqrt{\rho_{tot}}$,
and $\Delta\epsilon_{p}$ is the increment of plastic strain produced by
dislocation glide. The increments in stored and mobile dislocation densities
are generally proportional to $\Delta\rho_{tot}$. As portions of an expanding
dislocation loop can react with other loops and become immobilized it changes
the density of stored dislocations by $\Delta\rho_{stored}$. In this study, we
assume for simplicity that newly added dislocations have equal chance of
becoming mobile or stored. Thus, we arrive at the change per unit time $\Delta
t$: $\Delta\rho_{mob}=\Delta\rho_{stored}=\Delta\rho_{tot}/2.$

Mobile dislocations glide freely with a velocity distribution, which we
parameterize only with its average speed $v$ for convenience. In our
dislocation network picture, see Fig. 1, a dislocation can be pinned with
potential $U_{i}$ at local points, where it encounters other dislocations. We
assume that the dislocation overcomes the pinning potential and glides by the
combined effect of thermal activation (Arrhenius term) and external drive
$\tau_{app}$. This assumption is supported by the experimental observation
that mechanical stress increases with applied strain and decreases with
temperature. Kocks03 ; Kocks75 ; Wielke76  As the dislocation glides, the
whole line still undergoes resistance from the Peierls stress $\tau_{Peierls}$
and the mean-field dislocation-dislocation interaction stress $\tau_{int}$.
The average speed is thus described by a combination of thermodynamic
potential and attempt frequency for overcoming the barrierKocks75 ; Kocks03

$\displaystyle v(t)$ $\displaystyle=$ $\displaystyle b\nu_{D}\exp\left[-\Delta
G(t)/k_{B}T\right],$ (3) $\displaystyle\Delta G(t)$ $\displaystyle=$
$\displaystyle
U_{i}-\big{[}\tau_{app}(t)-\tau_{Peierls}-\tau_{int}(t)\big{]}V,$ (4)

where $\nu_{D}$ is the Debye or attempt frequency and $V=b^{2}\Lambda$ is the
activation volume. $\Lambda$ is assumed to be the average distance between
pinning points, which equals the interdislocation distance $L$, and $k_{B}$ is
the Boltzmann constant. The product $b\nu_{D}$ is a typical sound speed of the
solid, and $\Delta G$ is the thermodynamic Gibbs free energy for thermal
activation of glide. We model the interaction between dislocations to be long
ranged. In mean-field theory the interaction is inversely proportional to the
interdislocation distance of a randomly oriented dislocation forest, which
results in the resistive interaction stressKocks75 ; Mecking1981 ;
Lavrentev1980 ; Kocks03

$\displaystyle\tau_{int}(t)=\alpha\mu b\sqrt{\rho_{tot}(t)},$ (5)

with elastic shear modulus $\mu$ and dislocation interaction coefficient
$\alpha$. Indeed, the dependence of $\tau_{int}$ on $\sqrt{\rho_{tot}}$ has
been observed in many materials. Staker1972 ; Kocks75 ; Kocks03

We can now relate the macroscopic strain quantity with the above mentioned
microscopic quantities of dislocation motion. The total applied strain is
composed of both elastic and plastic strain,
$\epsilon_{app}\equiv\epsilon_{e}+\epsilon_{p}$, while the plastic strain rate
due to glide obeys the kinematic equation relating microscopic and macroscopic
quantitiesOrowan40 ; Kocks03

$\displaystyle\dot{\epsilon}_{p}(t)=bv(t)\,\rho_{mob}(t),$ (6)

with the increment of plastic strain per time step $\Delta t$:
$\Delta\epsilon_{p}(t)=\dot{\epsilon}_{p}(t)\Delta t.$ The corresponding
applied shear stress $\tau_{app}$ is given by Hooke’s law of elastic
deformation,

${\tau}_{app}(t)\equiv\mu\epsilon_{e}(t)=\mu\big{[}{\epsilon}_{app}(t)-{\epsilon}_{p}(t)\big{]}.$
(7)

This completes the set of thermodynamic and kinetic equations of our minimal
dislocation glide model developed for solid 4He.

###  II.2 Computation and model parameters

The coupled system of equations are solved numerically with a simple time-step
evolution method, because it is sufficient to employ the Euler forward method
to obtain the time evolution of the dynamics. In this work, we assume initial
conditions $\epsilon_{app}(0)=\epsilon_{p}(0)=0$ and
$\rho_{mob}(0)=\rho_{stored}(0)=0.5\rho_{tot}(0)$. First we solve Eq. (7) for
the increment of applied shear stress $\Delta{\tau}_{app}(t)$ at each time
step $\Delta t$ for an increment of applied strain
$\Delta\epsilon_{app}(t)=\dot{\epsilon}_{app}\Delta t$ with given dc strain
rate $\dot{\epsilon}_{app}$, based on the difference between applied strain
$\epsilon_{app}$ and plastic strain $\epsilon_{p}$. Then, we update the total
applied shear stress $\tau_{app}(t)$ to get the average speed $v(t)$ of
dislocations from Eqs. (3) and (4). This way we solve the differential
equation for the plastic strain rate $\dot{\epsilon}_{p}(t)$ in Eq. (6), which
implicitly depends on $\epsilon_{p}$, $\tau_{app}$ and $\tau_{int}$. Finally,
we update the increment of the total dislocation density $\rho_{tot}(t)$ in
Eq. (2) and the interaction stress $\tau_{int}(t)$ in Eq. (5).

In the calculations shown hereafter the pinning potential $U_{i}$ is set by
the melting temperature $T_{m}=1.86$ K with the assumption that the pinning is
from dislocation crossing or local melting. This strongly reduced value takes
into account the quantum fluctuations, because in classical crystals $U_{i}$
is of the order of the Debye temperature, which is roughly 26 K for hcp 4He.
For simplicity, we further assume that the Burgers vector is of the same
magnitude as the lattice constant, $b=0.364$ nm, which would correspond to
glide on either the basal or prismatic planes of the hcp crystal. We
approximate the Debye frequency as $\nu_{D}=\Theta_{D}k_{B}/h=$ 600 GHz with a
corresponding sound speed of $b\nu_{D}=218$ m/s and shear modulus $\mu=13.7$
MPa.Suzuki77  For the dislocation interaction coefficient, we use $\alpha$ =
0.01. This value is much smaller than for the hcp metal Zr,
$0.1<\alpha<2$,Beyerlein08 ; Lavrentev1980  or fcc Cu,
$0.5\lesssim\alpha\lesssim 1$ at room temperature.Mecking1981 ; Kocks03  A
strongly reduced value should be expected when quantum fluctuations and
interactions are important. In addition, it takes into account dislocation
screening effects as well as the screening due to 3He atoms bound to the
dislocation line.

The Peierls barrier is inferred from the recent ac shear displacement
experiments in which the softening happens at an applied strain larger than
$2.0\times 10^{-8}$.Day07 ; Day09 ; Syshchenko10  By interpreting the
softening of the solid as dislocation glide, we obtain
$\tau_{Peierls}=1.0\times 10^{-8}$$\mu$. This value is consistent with the
experiment by Sanders and coworkers,Sanders77  who reported a nearly vanishing
Peierls stress, whereas Hiki and TsuruokaHiki1983  reported a larger, but
still small $\tau_{Peierls}\approx 10^{-5}$$\mu$. On the other hand, Monte
Carlo simulations predicted much larger values for $\tau_{Peierls}\sim
0.006-0.03\mu$ for edge and screw dislocations, respectively.Pessoa2010
Clearly the experimentally reported values for the Peierls stress are
unusually small, which might be the combined effects of quantum fluctuations,
which play a role at low temperatures in reducing the barrier for the escape
of immobile dislocations and the nucleation of double kinks or small loops of
atomic size $b$ vs. $\Lambda$.Kocks75  If in fact the activation volume for
overcoming the Peierls barrier is on the order of $V=b^{3}$ rather than
$V=b^{2}\Lambda$, then the Peierls stress is effectively reduced by
approximately $b/\Lambda$ in our formulation of the energy barrier $\Delta G$
in Eq. (4). Everything else the same, we can either write for the potential
energy of the Peierls barrier $E_{P}=\tau_{Peierls}\times b^{2}\Lambda$ or
$E_{P}=\tau_{Peierls}^{eff}\times b^{3}$. Consequently,
$\tau_{Peierls}^{eff}\sim\tau_{Peierls}(\Lambda/b)=10^{-8}\mu\,\Lambda/b\sim
0.03\mu$ for typical dislocation density $\rho_{tot}=1/\Lambda^{2}=10^{6}$
m-2. This estimate of $\tau_{Peierls}^{eff}$ is also in reasonable agreement
with the Monte Carlo simulations.Pessoa2010  Thus a systematic study of the
Peierls stress or critical strain versus dislocation density may resolve the
true value of the Peierls stress.

Of course, all material parameters used above are subject to updates in
experiments. We believe that the most realistic result can be obtained once
the material parameters can be verified. In the next section, we will study
how the plastic nature is revealed in the WHR and other experimental
observables as well as a systematic study of the parameter dependence on the
results.

Figure 2: (color online). (a) Stress-strain curves for different temperatures
at an applied strain rate of $\dot{\epsilon}_{app}=10^{-3}$ s-1 with initial
total and mobile dislocation densities of $\rho_{tot}=1.0\times 10^{6}$ m-2
and $\rho_{mob}=0.5\times 10^{6}$ m-2. (b) Plot of the corresponding average
speed-strain curves of (a) are nearly identical at different temperatures. (c)
Plot of the corresponding dislocation density-strain curves of (a) are nearly
identical at different temperatures. (d) The “effective” shear modulus
$\mu_{eff}=\tau_{app}/\epsilon_{app}$ versus temperature; data for different
strains have been shifted to coincide at 300 mK.

##  III Results and discussion

###  III.1 Strain-stress curves

Dislocation glide manifests itself macroscopically as a change in the WHR.
Prior to the onset of dislocation glide, the solid behaves elastically and the
WHR equals the elastic shear modulus. At sufficiently large applied
deformation, some of the pre-existing stored dislocations become unpinned and
glide in reaction to the external stress. The glide of dislocations
accommodates the deformation strain and the slope of the stress-strain
response deviates from the shear modulus noticeably. The point of departure on
the stress-strain response is normally referred to as the yield point, with
corresponding yield strain and yield stress. Above the yield point is the so-
called plastic regime. In this study, the yield point of the stress-strain
curve is defined as the point where the ratio of applied stress over applied
strain equals $0.99\mu$. Although this criterion is arbitrary, it is easy to
implement and does not change any of the key results or conclusions.

The calculated results are in qualitative agreement with recent ac shear
experiments.Day07 ; Day09 ; Syshchenko10  In Fig. 2(a) we plot the predicted
shear stress-strain curves for solid 4He deformed under different temperatures
with an initial dislocation density $\rho_{0}=1.0\times 10^{6}$ m-2. Rojas11
We find that yield strains at all temperatures are roughly the same value of
$2.6\times 10^{-8}$, which is close to the critical strain $2.2\times 10^{-8}$
in the ac experiments.

The temperature effect is most apparent in the stress-strain curve above the
yield stress. At high temperature the WHR approaches zero, which means that
the material undergoes great plastic deformation even with minimum applied
stress. In Fig. 2(b) and (c), the temperature effect on the evolution of the
average speed and dislocation density are substantially weaker than the ones
shown for the parameters in panel (a). There are two reasons for this
difference: (1) The dislocation density in panel (c) is at the level of
$10^{6}$ m-2; thus, a small difference on the order of $10^{6}$ m-2 still has
a strong influence on the plastic strain rate calculated from Eq. (6),
especially when the applied strain rate is $\dot{\epsilon}_{app}=10^{-3}\,{\rm
s}^{-1}$. (2) The difference in stress-strain curves in Fig. 2(a) is a
consequence of the accumulated difference of plastic strain rates from each
time step. Thus, the temperature effect is much more prominent in the stress-
strain curves.

One can visualize the microscopic processes of the deformation through
macroscopic quantities. The average dislocation speed $v$ is of the order of
$\sim 2$ m/s or 1% of the speed of sound and is plotted in Fig. 2(b). It shows
that below the yield point $v$ is zero and a boost is found right at the yield
point. A slow decrease in $v$ above the yield strain occurs because the
increasing dislocation density increases the mean-field interaction and sets a
higher effective barrier for gliding. Notice that although the “average”
dislocation speed decreases, there are still fast dislocations to accommodate
the increasing external strain; this has been seen in an earlier study using
discrete dislocation dynamics.Wang07  On the other hand, the increase in
dislocation density $\rho$, see Fig. 2(c), is not as dramatic as for $v$,
which we found to be true for all of our calculations.

As seen in Fig. 2(a), the model also predicts a strong temperature dependence
for the stress-strain curve, which follows directly from the kinetics embedded
in the model of Eq. (2). The rate of dislocation motion across the solid is
assumed to be controlled by thermally activated glide, Eq. (2), and therefore,
higher temperatures facilitate dislocation glide, enabling dislocations to
glide faster at lower stresses.

To summarize and allow direct comparison with experiments, we re-plot Fig.
2(a) as an effective shear modulus $\mu_{eff}\equiv\tau_{app}/\epsilon_{app}$
in Fig. 2(d). Note that this is the definition used in the ac shear
experiments, rather than the WHR, irrespective of the value of the applied
strain. One can see that the $\mu_{eff}$ curve decreases with increasing
temperature, while the zero-temperature value $\mu_{eff}(0)$ decreases with
increasing applied strain, which is in qualitative accordance with
experiments. It is encouraging that our dc strain-rate model actually captures
the essential features of the ac shear modulus experiments.

Figure 3: (color online). (a) Stress-strain curves for high (HD) and low (LD)
initial dislocation densities at $\dot{\epsilon}_{app}=10^{-3}$ s-1. (b) Plot
of the corresponding dislocation density-strain curves of (a). (c) Plot of the
corresponding WHR-strain curves of (a). (d) The WHR versus $T$ for HD and LD
cases. The curves for HD and LD cases correspond to the initial total
dislocation density of $1.0\times 10^{6}$ m-2 and $2.0\times 10^{6}$ m-2,
respectively. All data are taken from the same strain amplitude at
$\epsilon_{app}=2.650\times 10^{-8}$.

###  III.2 Dislocation density dependence

Figure 4: (color online). Plastic dissipation curves corresponding to the WHR
curves of Fig. 3(d) for low (LD) and high (HD) densities of dislocations.

We show through varying the initial dislocation density that our model
describes reported annealing experiments.Day09  Dislocations are created
during the growth process and can either be increased or decreased by pre-
stressing or annealing. In the calculation we focus on two initial dislocation
line densities of high density (HD), $2.0\times 10^{6}$ m-2, and low density
(LD), $1.0\times 10^{6}$ m-2, which correspond to an as-grown and annealed
sample, respectively. We see again the plastic behavior above the yield point.
The yield point is higher for the HD case, see Fig. 3(a). This can be
understood since the larger mean-field interaction in the HD sample possesses
a stronger resistance to gliding, because with increasing density the
interaction stress $\tau_{int}$ increases as described by Eq. (3). Notice that
the increase in dislocation density after applying external strain is
negligible, as shown in Fig. 3(b). This behavior is thus mainly determined by
the initial dislocation density. In general the HD case also shows a larger
crossover zone from the elastic to plastic regime, since a larger activation
is required for dislocation lines to glide. We also compare the temperature
effect on the two different density samples. In the temperature range of
interest, 20-200 mK, the distinction between the two densities is clear. To
better see the temperature effect, we plot the WHR as a function of
temperature (Fig. 3(d)) at a given applied strain, $\epsilon_{app}=2.65\times
10^{-8}$. The WHR of the HD case deviates from the zero-temperature shear
modulus at higher temperatures, approximately at 100 mK, compared to the LD
scenario, which deviates at approximately 20 mK. This is because the larger
dislocation interaction sets a higher barrier that requires a higher
temperature to thermally activate glide. Again it is encouraging to see that
our simple dislocation glide model captures the essential features of the ac
shear experiments between as-grown and annealed samples.Day09

Figure 5: (color online). (a) Stress-strain curves for different applied
strain rates at $\dot{\epsilon}_{app}=10^{-3}$ s-1; (b) plot of the
corresponding average speed-strain curves of (a); (c) plot of the
corresponding work-hardening rate-strain curves of (a); (d) work-hardening
rate, WHR, versus temperature for different applied strain rates. (The curves
for high and low applied strain rates correspond to $10^{-2}$ and $10^{-4}$
s-1, respectively). All data are taken from the same strain amplitude at
$\epsilon_{app}=2.650\times 10^{-8}$.

###  III.3 Dissipative glide

Dissipation is one of the essential features of dislocation glide described in
this paper. To overcome barriers and obstacles when gliding, a dislocation
dissipates energy $W_{p}=\tau_{app}\,\Delta\epsilon_{p}$ per time step $\Delta
t$. The corresponding dissipation rate is expressed as $\dot{W}_{p}$. From
this expression it is easy to see that significant dissipation or damping
happens only in the plastic regime above the yield point $\tau_{y}$, where
${\epsilon}_{p}>0$. In general, a dissipation peak accompanies a drastic
change in the WHR as a function of temperature. The plastic dissipation
corresponding to the WHR in Fig. 3(d) is shown in Fig. 4. Here, the
dissipation peak is centered near the temperature, where the WHR,
$d\tau/d\epsilon$, is changing most rapidly, see Fig. 3(d). This behavior is
similar to the one seen in the inverse quality factor $1/Q$ of ac shear
experiments. In addition, the position of the peak shifts to lower
temperatures as the dislocation density decreases from the HD to LD scenario
and the height of the peak increases with decreasing dislocation density. This
narrowing of the dissipation peak can be understood in terms of fewer
dislocations in the system resulting in fewer mobile dislocations with larger
mean-free path to move. Again, that in turn causes a faster release of stored
elastic energy in the system.

###  III.4 Strain rate dependence

Next, we study the effect of the key control parameter in experiment on the
plastic response of solid 4He, namely, the applied strain rate
$\dot{\epsilon}_{app}$. Thermally activated rate-controlled dislocation glide
implies a sensitivity to the applied strain rate. Two different strain rates
were used in the following calculations: a low strain rate (LSR) of
$10^{-4}\,{\rm s}^{-1}$ and a high strain rate (HSR) of $10^{-2}\,{\rm
s}^{-1}$. In Fig. 5(a)-(c) we compare the model results for low and high
strain rates. From Fig. 5(a) we can see that increasing the strain rate
increases the yield stress and yield strain. In other words, as the strain
rate increases, the transition from the elastic to plastic regime is delayed.

This delay is due to the failure of plastic deformation to respond fast enough
(at each time step) to the large applied strain rate for HSR. The plastic
strain rate, $\dot{\epsilon}_{p}\propto v$, is roughly ten times larger for
HSR (Fig. 5 (b)) while the applied strain is in fact a hundred times larger.
The plastic deformation, therefore, does not affect the applied stress much
until a much larger strain is applied, see Eq. (7); the yield point then
happens at a higher drive.

Further, we observe that the sensitivity of the yield stress and strain to
strain rate is enhanced at higher temperatures. Since the yield stress in the
high strain rate case is higher, the driving force for dislocation glide is
larger, causing the dislocations on average to speed up as shown in Fig. 5(b).
This sensitivity can also be seen in the variation in the WHR,
$d\tau/d\epsilon$, shown in Fig. 5(c). Here we see that the extent of the
elastic regime is wider at the higher temperature. Fig. 5(d) compares the
$d\tau/d\epsilon$ from high to low temperatures at different strain rates. Two
features are revealed. First, changing the strain rate does not affect the low
temperature behavior, i.e., below 20 mK. Second, compared to the HSR case, the
WHR decreases more rapidly in the LSR case, resulting in a larger drop of the
WHR at the same amount of applied strain. Notably, the latter feature can also
be found in the ac shear experiments, Day07 ; Syshchenko10  although the
impact on the WHR is not as obvious as in our calculations. The difference may
be related to the usage of $\mu_{eff}$ rather than the WHR in experiments or
the different loading methods in ac versus dc experiments or the boundary
conditions. Zhou12

###  III.5 Model parameter dependence

Finally, it is important to characterize the material parameter dependence of
our model results. A suitable experimentally observable quantity for that
purpose is the yield point. We study systematically the effect of the pinning
potential $U_{i}$, the Peierls barrier $\tau_{Peierls}$, and the dislocation
interaction strength $\alpha$ at 20 mK and 300 mK, since they play important
roles in determining the average dislocation speed $v$ given in Eq. (3) and
the WHR. We keep all model parameters the same as in Sec. III.A, except for
the parameter whose dependence on the yield stress is investigated.

Figure 6: (color online). Plot of yield stress $\tau_{y}$ versus pinning
potential $U_{i}$ at both low (20 mK) and high (300 mK) temperatures.

Figure 7: (color online). Plot of yield stress $\tau_{y}$ versus dislocation
interaction strength $\alpha$ at both low (20 mK) and high (300 mK)
temperatures.

Figure 8: (color online). Plot of yield stress $\tau_{y}$ versus pinning
potential $\tau_{Peierls}$ at both low (20 mK) and high (300 mK) temperatures.

All parameters represent physical barriers to dislocation glide. Accordingly,
the yield stress $\tau_{y}$ increases with all three parameters as expected
(Fig. 6, 7, 8). Among the three parameters, the dependence on $U_{i}$ is least
crucial, see Fig. 6, since the value of $U_{i}$ is known to be restricted by
the melting temperature $T_{m}=1.86$ K. (1) The yield stress $\tau_{y}$ varies
by less than an order of magnitude in the given range of $U_{i}$ values with
the scaling relation $\tau_{y}\sim 0.1\,U_{i}\,{\rm Pa\over K}$. (2) The
interaction strength $\alpha$, although difficult to control in experiments,
is believed to range between 0.1 to 2 when compared with reported values for
ordinary metals. In our model calculations we chose $\alpha=0.01$ to properly
describe the WHR. This strongly reduced value, compared to ordinary metals,
might be caused by interdislocation screening effects originating from quantum
fluctuations. Our calculation shows that $\tau_{y}$ varies by roughly an order
of magnitude for $\alpha$ between 0.01 and 1, see Fig. 7. The curve saturates
below $\alpha<0.01$, because then $\tau_{y}$ is dominated by other barrier
types, e.g., Peierls barrier. For $\alpha>10^{-2}$ an approximate scaling of
$\tau_{y}\approx(0.14+5\alpha)\,{\rm Pa}$ can be inferred. (3) For the Peierls
potential, however, the yield stress changes by more than three orders of
magnitude over the reported range shown in Fig. 8. It satisfies a simple
scaling relation $\tau_{y}\propto 1.4\cdot 10^{7}\,\tau_{Peierls}/\mu\,{\rm
Pa}\approx\tau_{Peierls}$, which can be used to estimate the order of
magnitude of the Peierls barrier. From this work it has become clear that a
reliable and independent determination of the Peierls barrier is needed. On
the other hand, increasing temperature accentuates the parameter dependence on
$\tau_{y}$ in general, because the solid is softer at higher temperatures.
Fortunately, the temperature dependence of $\tau_{y}$ versus $\tau_{Peierls}$,
the least well-known parameter in our dislocation model, is negligible.

##  IV Conclusion

In summary, we proposed and studied a model of dc strain rate driven
dislocation glide in solid 4He. We predict stress-strain curves and work-
hardening rates as well as the role of the dislocation interactions and
Peierls barriers. We find that the effective shear modulus (ratio of stress
over strain) can exhibit, what appears to be, anomalous elasticity. Based on
our predictions for the effective shear modulus and work-hardening rate, this
anomaly is caused by the free glide of dislocations. It can be described
rather well by classical theories of plastic deformation with renormalized
model parameters due to zero-point fluctuations of the quantum solid. No
supersolidity or quantum mechanism is required to explain these effects.

One may speculate about the realm of quantum and super plasticity in the
quantum solid helium. So far the results of our classical thermally activated
dislocation glide model would suggest that quantum tunneling of dislocation
lines has not yet been seen in experiments. Indeed, measurements of the
dynamic shear modulus down to 20 mK confirm the dominance of thermally
activated relaxation behavior in the dissipation process.Syshchenko10 ; Su2010
; Su2011

Our predictions for the strain-stress curve in dc strain rate measurements are
obtained with very reasonable parameter values. Since the parameter range is
generally constrained, the model gives rather robust predictions for the
stress-strain curve, which is encouraging particularly in the event that some
of the parameters need to be updated with the advent of more accurate
materials characterization. Future dc experiments can certainly narrow down
the range of values for some of the model parameters. For example, our model
calculations show over a wide range simple linear relations between yield
stress and Peierls stress, $\tau_{y}\propto\tau_{Peierls}$, yield stress and
pinning potential, $\tau_{y}\propto U_{i}$, and yield stress and screening
strength of the dislocation interaction, $\tau_{y}\propto\alpha$. In addition,
we find a direct relationship between the work-hardening rate and the applied
strain rate as well as the dislocation density that resembles the effects of
frequency and annealing process reported in ac shear strain experiments.
Furthermore, using current parameters, our stress-strain curve predictions
reveal that dislocations glide freely with an average speed of 1 to 5 m/s,
which is about 1% of the speed of sound in solid 4He and significantly faster
than estimates based on the Granato-Lücke theory of vibrating dislocations
would suggest.Haziot2013b

Although the current dislocation glide model does not predict hysteresis, it
can be extended, in principle, to capture the irreversible processes of
creation and annihilation of dislocations during loading and reverse loading.
We encourage and welcome experiments that will allow a more precise dynamical
and structural characterization of the quantum solid 4He to provide stringent
tests on quantum vs. classical dislocation glide at low temperatures.

###### Acknowledgements.

We acknowledge helpful discussions with C. J. Olson-Reichhardt, J. Toner, and
Z. Nussinov. This work was supported by the U.S. DOE at Los Alamos National
Laboratory under contract No. DE-ac52-06NA25396 through the Office of Basic
Energy Sciences, Division of Materials Sciences and Engineering. C. Z.
acknowledges support by the Center for Nonlinear Studies through the LANL LDRD
program and the Materials Research Center at Missouri S&T.

## References

  * (1) E. Kim and M. H. W. Chan, Nature (London) 427, 225 (2004); Science 305, 1941 (2005).
  * (2) A. S. C. Rittner and J. D. Reppy, Phys. Rev. Lett. 97, 165301 (2006); 98, 175302 (2007).
  * (3) M. Kondo, S. Takada, Y. Shibayama, and K. Shirahama, J. Low Temp. Phys. 148, 695 (2007).
  * (4) Y. Aoki, J. C. Graves, H. Kojima Phys. Rev. Lett. 99, 015301 (2007).
  * (5) A. Penzev, Y. Yasuta, and M. Kubota, Phys. Rev. Lett. 101, 065301 (2008).
  * (6) B. Hunt et al., Science 324, 632 (2009).
  * (7) E. J. Pratt et al., Science 332, 821 (2011).
  * (8) J. Day and J. Beamish, Nature 150, 853 (2007).
  * (9) J. Day, O. Syshchenko and J. Beamish, Phys. Rev. B 79, 214524(2009).
  * (10) J. T. West, O. Syshchenko, J. Beamish, and M. H. W. Chan, Nature Phys. 5, 598 (2009).
  * (11) Yu. Mukharsky, A. Penzev, and E. Varoquaux, Phys. Rev. B 80, 140504(R) (2009).
  * (12) O. Syshchenko, J. Day, and J. Beamish, Phys. Rev. Lett. 104, 195301 (2010).
  * (13) X. Rojas, A. Haziot, V. Bapst, S. Balibar, and H. J. Maris, Phys. Rev. Lett. 105, 145302 (2010).
  * (14) D. Y. Kim and M. H. W. Chan, Phys. Rev. Lett. 109, 155301 (2012).
  * (15) I. Iwasa, K. Araki, and H. Suzuki, J. Phys. Soc. Jpn. 46, 1119 (1979).
  * (16) M. A. Paalanen, D. J. Bishop, and H. W. Dail, Phys. Rev. Lett. 46, 664 (1981).
  * (17) Y. Hiki and F. Tsuruoka, Phys. Rev. B 27, 696 (1983).
  * (18) I. Iwasa, Phys. Rev. B 81, 104527 (2010).
  * (19) I. Iwasa, J. Low Temp Phys. 171, 287 (2013).
  * (20) H. Mecking and U. F. Kocks, Acta Metall. 29, 1865 (1981).
  * (21) E. Orowan, Dislocations in Metals, ed. by M. Cohen, (American Institute of Mining and Metallurgical Engineers, New York, 1954).
  * (22) J. Friedel, Dislocations (Pergamon Press, Oxford, 1967).
  * (23) F. Nabarro, Theory of crystal dislocations in Series: Dislocations in crystals (Clarendon Press, Oxford, 1967).
  * (24) D. Hull and D. J. Bacon, Introduction to Dislocations (Butterworth-Heinemann, Oxford, 2011).
  * (25) U. Essman and H. Mughrabi, Phil. Mag. A, 40, 731 (1979).
  * (26) I. J. Beyerlein and C. N. Tomé, Int. J. Plasticity 24, 867 (2008).
  * (27) D. W. Brown, I. J. Beyerlein, T. A. Sisneros, B. Clausen, and C.N. Tomé, Inter. J. Plasticity 29, 120 (2012).
  * (28) P. B. Hirsch, Internal Stresses and Fatigue in Metals, (Elsevier, Amsterdam, 1959), p. 139.
  * (29) J. Friedel, Electron Microscopy and Strength of Crystals, (John Wiley & Sons, NY, 1963), p. 605.
  * (30) G. Saada, Electron Microscopy and Strength of Crystals, (John Wiley & Sons, New York, 1963). p. 651.
  * (31) A. Seeger, S. Mader, H. Kronmüller, Electron Microscopy and Strength of Crystals, (John Wiley & Sons, New York, 1963), p. 665.
  * (32) U. F. Kocks, A. S. Argon, and M. F. Ashby, Prog. Mater. Sci. 19, 1 (1975).
  * (33) G. I. Taylor, Proc. Roy. Soc. A145, 362 (1934).
  * (34) E. Orowan, Proc. Phys. Soc. 52, 8 (1940).
  * (35) B. Wielke, phys. stat. sol. (a) 33, 241 (1976).
  * (36) U. F. Kocks and H. Mecking, Prog. Mater. Sci. 48, 171 (2003).
  * (37) A. D. Fefferman, X. Rojas, A. Haziot, S. Balibar, J. T. West, M. H. W. Chan, Phys. Rev. B 85, 094103 (2012).
  * (38) A. Haziot, X. Rojas, A. D. Fefferman, J. R. Beamish, and S. Balibar, Phys. Rev. Lett. 110, 035301 (2013).
  * (39) A. Haziot, A. D. Fefferman, J. R. Beamish, and S. Balibar, Phys. Rev. B 87, 060509(R) (2013).
  * (40) A. Eyal and E. Polturak, arXiv:1202.1392 (2012)
  * (41) A. Eyal, E. Livne, and E. Polturak, arXiv:1206.0938 (2012)
  * (42) M. Khantha, D. P. Pope, and V. Vitek, Phys. Rev. Lett. 73, 684 (1994).
  * (43) J. Zaanen, Z. Nussinov, and S. I. Mukhin, Ann. Phys. 310, 180 (2004).
  * (44) L. Proville, D. Rodney, and M.-C. Marinica, Nature Mater. 11, 845 (2012); doi: 10.1038/nmat3401.
  * (45) C. Zhou, J.-J. Su, M. J. Graf, C. Reichhardt, A. V. Balatsky, and I. J. Beyerlein, Philos. Mag. Lett. 92, 608 (2012).
  * (46) See the Supplemental Material at http://link.aps.org/supplemental/10.1103/PhysRevB.x.x for technical details on the 3D dislocation network simulation and the animation of plastic glide.
  * (47) F. F. Lavrentev, Mater. Sci. Eng. 46, 191 (1980).
  * (48) M. R. Staker, and D. L. Holt, Acta Metall. 20, 569 (1972).
  * (49) H. Suzuki, J. Phys. Soc. Jpn. 42, 1865 (1977).
  * (50) D. J. Sanders, H. Kwun, A. Hikata, and C. Elbaum, Phys. Rev. Lett. 39, 815 (1977).
  * (51) R. Pessoa, S. A. Vitiello, and M. de Koning, Phys. Rev. Lett. 104, 085301 (2010).
  * (52) Z. Q. Wang, I. J. Beyerlein, and R. Lesar, Philos. Mag. 87, 2263 (2007).
  * (53) J.-J. Su, M. J. Graf, and A. V. Balatsky, Phys. Rev. Lett. 105, 045302 (2010).
  * (54) J.-J. Su, M. J. Graf, and A. V. Balatsky, J. Low Temp. Phys. 162, 433 (2011).

## Supplemental Material

The animation accompanying the Supplemental Material and depicted in the Fig.
(1) of the main text shows the results from a three-dimensional discrete
dislocation dynamics (3D DDD) simulation.s1 ; s2  In the 3D DDD simulation,
the dislocation lines have been discretized into segments, in which the
dislocations are the simulated entities for studying the effects of
plasticity. Recently, this method has been used to examine the role of
dislocation multiplication and mobility on the plasticity in small samples.
Application was made to single-crystal fcc Ni to compute the elastic field,
forces, and motion of dislocation loops.s2

## References

  * (1) N. M. Ghoniem, S. H. Tong, and L. Z. Sun, Parametric Dislocation Dynamics: A Thermodynamcis-based Approach to Investigations of Mesoscopic Plastic Deformation, Phys. Rev. B 61, 913 (2000).
  * (2) C. Zhou, S. B. Biner, and R. LeSar, Discrete dislocation dynamics simulations of plasticity at small scales, Acta Mater. 58, 1565 (2010).


# Parallel Instance Filtering for Malware Detection
††thanks: This work was supported by the OP VVV MEYS funded project
CZ.02.1.01/0.0/0.0/16_019/0000765 ”Research Center for Informatics” and by the
Grant Agency of the CTU in Prague, grant No. SGS21/142/OHK3/2T/18 funded by
the MEYS of the Czech Republic.

Martin Jureček and Olha Jurečková  Department of Information Security
Faculty of Information Technology, Czech Technical University in Prague,
Czechia
<EMAIL_ADDRESS>
###### Abstract

Machine learning algorithms are widely used in the area of malware detection.
With the growth of sample amounts, training of classification algorithms
becomes more and more expensive. In addition, training data sets may contain
redundant or noisy instances. The problem to be solved is how to select
representative instances from large training data sets without reducing the
accuracy. This work presents a new parallel instance selection algorithm
called Parallel Instance Filtering (PIF). The main idea of the algorithm is to
split the data set into non-overlapping subsets of instances covering the
whole data set and apply a filtering process for each subset. Each subset
consists of instances that have the same nearest enemy. As a result, the PIF
algorithm is fast since subsets are processed independently of each other
using parallel computation. We compare the PIF algorithm with several state-
of-the-art instance selection algorithms on a large data set of 500,000
malicious and benign samples. The feature set was extracted using static
analysis, and it includes metadata from the portable executable file format.
Our experimental results demonstrate that the proposed instance selection
algorithm reduces the size of a training data set significantly with the only
slightly decreased accuracy. The PIF algorithm outperforms existing instance
selection methods used in the experiments in terms of the ratio between
average classification accuracy and storage percentage.

###### Index Terms:

instance selection, malware detection, machine learning

##  I Introduction

Machine learning (ML) algorithms are widely employed in the area of malware
detection [1]. AV-Test Institute [2] registers over 450 000 new malware
samples and potentially unwanted applications every day. This indicates that
antivirus companies must deal with a large amount of training data. Training
data sets usually contain many irrelevant samples, which do not contribute to
improving detection accuracy. In addition, some samples are manually labeled
by malware analysts, which may result in incorrect labels.

The training phase of ML algorithms is time expensive. Reducing training time
and cleaning training sets are two main reasons to incorporate instance
selection algorithms [3] into malware detection systems. The goal of an
instance selection algorithms is to remove redundant and noise instances from
a given training data set while keeping or even increasing the classification
accuracy.

Feature selection and extraction algorithms are among the most important
preprocessing steps in data science tasks. Instance selection is becoming
increasingly relevant due to the large number of samples that are constantly
being generated. Since the computational complexity of the most instance
selection algorithms is at least $O(n^{2})$ where $n$ is a number of instances
[4], most of the algorithms are not applicable for larger data sets.

In this paper, we propose a parallel instance selection algorithm based on
splitting the whole training data set into disjoint subsets and applying a
filtering rule to each subset. The union of the reduced subsets then forms the
reduced training data set. We focus on the binary classification problem,
where we try to distinguish between malicious and benign programs. The
experiments were conducted for the data from the portable executable (PE) file
format [5], the most widely used file format for malware samples for personal
computers.

The main contributions are as follows. We propose a novel parallel instance
selection algorithm called Parallel Instance Filtering (PIF). The algorithm is
easy to implement and fast since it processes independent subsets of the data
set rather than the whole data set. We compared the PIF algorithm with four
state-of-the-art instance selection algorithms for medium-sized training data
sets and large-sized training data sets containing up to 400,000 high-
dimensional samples. While the computational times of state-of-the-art methods
were too high for processing more than 100,000 samples, the PIF algorithm
could process any subset of our data set. We used the stratification strategy
for the large training data sets to compare the PIF algorithm with other
instance selection algorithms. For both medium and large data sets, the PIF
algorithm achieved the results of the state-of-the-art algorithms considered
in our experiments.

This paper is organized as follows. Section II provides a brief introduction
to malware detection and reviews some instance selection algorithms. Section
III presents our proposed instance selection algorithm. Experimental setup is
given in Section IV, and Section V describes the experimental results.
Finally, Section VI concludes the paper and presents the future work.

##  II Background and Related Work

This section provides a brief background for malware detection and also
presents the state-of-the-art instance selection algorithms used in the
experiments. The rest of this section reviews some instance selection
techniques suitable for large data sets.

###  II-A Background

####  II-A1 Malware Detection

Malware authors adapt their malicious programs frequently to bypass antivirus
programs that are regularly updated. Packing, encryption, polymorphism,
metamorphism, and other code obfuscation techniques [6] are widely used by
malware authors to evade signature detection techniques [7].

Packing and encryption are two of the most popular techniques. These
techniques apply compression or encryption algorithms to avoid signature-based
detection and static analysis [8]. Polymorphic and metamorphic malware can
change their code with each new generation. When such malware is executed, it
can be obfuscated again to avoid signature-based detection.

Obfuscation can be applied on several layers, such as code, a sequence of
instructions, or binary content. Even a small malware change can invalidate an
existing signature and cause the modified malware not to be detected
immediately after the modification. As a result, training data sets may
contain many samples that are similar to each other with respect to a
similarity function defined on a feature set. However, while the number of
training samples increases, the learning speed decreases. In addition, similar
training samples do not provide much new information for machine learning
classifiers. Therefore, it is convenient to reduce the training data set by
selecting only representative samples.

Malware detection techniques can be classified into two categories depending
on how code is analyzed: static and dynamic analysis. The static analysis aims
at searching for information about the structure and data in the file. The
disassembly technique is an example of a static analysis technique used to
extract various features from the executables. The dynamic analysis [9] aims
to examine a program executed in a real or virtual environment.

Many malware researchers have focused on ML algorithms to defeat obfuscation
techniques and detect unknown malware. Malware detection problems are often
defined as classification or clustering problems. The choice of ML algorithms
depends on whether training data is labeled or not and depends on data
representation. The works [10] and [1] survey the most popular machine
learning techniques for malware classification in the Windows operating
system.

Our work is based on static analysis. The most important drawback is that data
captured from the static analysis does not describe the complete behavior of a
program since the program is not executed. Since dynamic analysis involves
running the program, information from this kind of analysis is more relevant
than information from static analysis. However, dynamic analysis is more time-
consuming than static analysis, and several anti-virtual machine technologies
[11] can evade detection systems based on dynamic analysis. Since dynamic
analysis could be impractical for a large volume of samples that come to
antivirus vendors daily, the static analysis still has its place in malware
detection systems. A comparison of these two approaches is presented in [12].

####  II-A2 Instance Selection Algorithms

The goal of instance selection algorithms is to reduce training data sets by
selecting only representative instances while keeping (and possibly improving)
accuracy. The work [3] reviews several instance selection algorithms and
discusses their properties. In [13], the authors provide extensive comparative
experiments of instance selection algorithms evaluated using the $k$-nearest
neighbor (KNN) classifier. The work [14] compares instance selection
algorithms for 30 data sets from different domains, and the authors report
that neither instance selection algorithm consistently outperforms the other.

The main disadvantage of instance selection algorithms is high computational
complexity. Thus, they are not applicable to large-size data sets. To avoid
this drawback, the stratified strategy [15] is combined with instance
selection algorithms and achieves good results compared to instance selection
algorithms without stratification.

The stratified strategy splits the training set randomly into disjoint subsets
of equal size, maintaining class distribution within each subset. Then, an
instance selection algorithm is applied to each subset, and the resulting
reduced training set is obtained by joining the reduced subsets.
Stratification allows us to run any instance selection algorithm on small
subsets instead of a large set of instances. As a result, reducing of small
subsets can be run in parallel. We use the stratified strategy in our
experiments when we compare the PIF algorithm with other instance selection
algorithms for large-sized data sets.

There are several ways to categorize instance selection algorithms. We divide
instance selection algorithms, as in [3], into two groups: filter methods and
wrapper methods. While the selection criterion of wrapper methods is based on
the accuracy of the classifier, the selection criterion of filter methods is
not based on a classifier but rather on the values of the feature vector.

In this work, we focus on wrapper methods. In the rest of this section, we
briefly describe the methods we used in the experiments. The detailed
description of these methods can be found in [3].

Condensed nearest neighbor (CNN) [16] is probably the first published instance
selection algorithm. The objective of CNN is to find a consistent set, i.e., a
subset $S$ of training set $T$ that correctly classifies (using $S$ as the
training set) every instance in $T$ with the same accuracy as when $T$ is used
as the training set. CNN does not produce a minimal consistent set if
redundant instances were added to the consistent set in the early steps. CNN
is order-dependent and sensitive to random initialization of consistent set.

Edited Nearest Neighbor (ENN) [17] is focused on filtering noisy instances in
a training set. An instance is removed if its class does not coincide with the
majority class of its $k$ nearest neighbors. We use ENN as a noise filter in
our proposed instance selection algorithm described in the next section.

Wilson and Martinez introduced the Decremental Reduction Optimization
Procedure (DROP) family methods [18] which are very popular as they outperform
several previously proposed state-of-the-art methods. DROP methods are based
on the concept called associate. An instance $p$ is the associate of the
instance $q$ if $q$ is one of $k$ nearest neighbors of the instance $p$. DROPs
methods remove an instance $q$ if its associates can be classified without
$q$. Among five methods, DROP1-DROP5, we selected DROP3 since it achieved the
best mix of storage reduction and generalization accuracy [19].

Iterative Case FilteringAlgorithm (ICF) [20] uses two special sets, Coverage
and Reachable, that are related to the concepts of neighborhood and set of
asociates used in DROP algorithm. The definitions are as follows:

$\textrm{Reachable(x)}=\\{y\in S:y\in\textrm{LocalSet($x$)}\\}$
$\textrm{Coverage(x)}=\\{y\in S:x\in\textrm{LocalSet($y$)}\\}$

where the LocalSet($x$) is defined by the set

$\\{y\in
S:\textrm{cl(y)}=\textrm{cl(x)}\land\mathcal{D}(x,y)<\mathcal{D}(x,NE_{x})\\},$

where $cl(x)$ denotes the class of $x,$ $\mathcal{D}$ denotes the distance
function, and $NE_{x}$ denotes the nearest enemy of $x$, i.e., a nearest
instance to $x$ having different class label. When the cardinality of the
corresponding reachable set is greater than the cardinality of the
corresponding coverage set, then the instance is removed from the training
set. The first step of ICF consists of the noise filtering scheme based on
ENN. The reason is such that if some instance is noisy, then the cardinality
of both a reachable set and a coverage set will be one.

Modified Selective Subset (MSS) [21] is based on concept of selective subset
which is defined as follows:

A subset $S$ of the training set $T$ is a selective subset, if

  1. 1.

$S$ is consistent

  2. 2.

all instances in $T$ are closer to any instance of $S$ of the same class than
to any enemy in $T$

The authors of MSS proposed an iterative procedure to find the modified
selective subset, which is defined as the subset of the training set $T$ which
contains, for every instance $x$ in $T$, the element of its neighborhood that
is the closest to the nearest enemy of $x$.

###  II-B Related Work

In malware detection, there is a distinct lack of experimentation with
instance selection methods applied on large and real-world data sets from the
Windows environment. To the best of our knowledge, this paper is one of the
first works on instance selection for malware detection. Therefore, this
section reviews only instance selection algorithms that were applied to data
from different areas, such as biology or medicine.

MapReduce framework [22] is another way how to accelerate instance selection
algorithms. The framework was used in work [23] for instance selection with
data sets up to 5.7 millions of instances. Locality-sensitive hashing (LSH)
[24] can be used to support the calculation of nearest neighbors [25]. The
work [26] proposed an instance selection algorithm with linear complexity
using LSH to find similarities between instances.

In [4], the authors proposed a method for scaling up instance selection
algorithms. The original data set is partitioned into disjoint subsets using
the theory of Grand Tour [27]. An instance selection algorithm is applied to
each subset, and the results are combined using a voting scheme to achieve a
low testing error and high storage reduction.

##  III Proposed Method

This section presents a novel instance selection method called the Parallel
Instance Filtering (PIF) algorithm. The PIF algorithm is a wrapper method and
belongs among decremental methods, i.e., instances are removed from the
original data set according to some selection rule.

The PIF algorithm consists of three components:

  1. 1.

Wilson Editing noise-filtering procedure - incorrectly classified instances
using KNN classifier are removed.

  2. 2.

partitioning the data set - creating disjoint subsets $S_{NE}$ corresponding
to nearest enemies $NE$,

  3. 3.

applying filtering rule - filter out instances from each subset $S_{NE}$
according to a filtering rule.

In the first step of the PIF algorithm, we apply the Wilson Editing noise-
filtering procedure, which is presented in Algorithm 1.

Algorithm 1 Wilson Editing noise-filtering procedure

0: $T$ \- original training set, $k$ \- number of nearest neighbors

0: filtered training set $S$

1: for all points $x$ from $T$ do

2: find $k$ nearest neighbors of $x$ in $T$ (excluding $x$)

3: classify $x$ using KNN

4: end for

5: for all points $x$ from $T$ do

6: if $x$ is classified incorrectly then

7: remove $x$ from $T$

8: end if

9: end for

10: return $T$

This procedure is similar to ENN [17], and its strategy is to filter out
incorrectly classified instances. This includes noisy instances as well as
boundary instances. If the procedure was not included in the first step of the
PIF algorithm, then this would result in increasing the number of subsets and
decreasing their size.

Note that the Wilson Editing noise-filtering procedure for filtering noise and
smoothing borders is commonly used in the first step of instance selection
algorithms. This procedure is, for example, included in the DROP3 and the ICF
algorithms.

However, Wilson Editing noise-filtering procedure cannot remove redundant
internal instances which do not provide any information for the classifier in
the training process. Therefore, the PIF algorithm applies a filtering rule to
remove such instances that are irrelevant for training the classifier.

In the second step of the PIF algorithm, all instances in the training data
set that were not filtered out are then divided into disjoint subsets
according to their nearest enemies. If some instance has two or more distinct
nearest enemies, we can randomly choose one of them and omit the others.

The reason why we always can decompose the training data set $T$ into disjoint
subsets covering the whole data set is as follows. Let $x,y$ be two instances
from $T$ and consider the following relation $\sim_{NE}$ on $T$:

$y_{1}\sim_{NE}y_{2}\textrm{ if and only if }NE_{y_{1}}=NE_{y_{2}}$

If each instance $y$ has a unique nearest enemy $NE_{y}$ then it is easy to
see that the relation $\sim_{NE}$ is an equivalence relation. Therefore,
equivalence classes $[x]_{NE}=\\{y\in T\mid x=NE_{y}\\}$ form a decomposition
of $T$.

After decomposition of the training data set each subset is reduced
independently by applying the following filtering rule:

remove an instance $y$ from the subset $S_{NE}$ if and only if there is $x\in
S_{NE}$ such that

$\mathcal{D}(y,NE)\geq\max\\{\mathcal{D}(y,x),\mathcal{D}(x,NE)\\}$ (1)

where $\mathcal{D}$ is a distance function defined for the feature vectors
from the training set $T.$ This filtering rule is shown in Fig. 1 where the
point $z$ highlighted in a square is the nearest enemy for the remaining
points. The figure demonstrates that the points $b$ and $c$ will be removed,
however, the points $d$ and $e$ are retained. Since the Wilson Editing noise-
filtering procedure did not remove the points $d$ and $e$, they are probably
not noisy instances or outliers. For example, the reason for retaining the
point $e$ is that there is no point $x$ such that:

  * •

$x$ is closer to $z$ than the point $e$, and

  * •

$e$ is closer to $x$ than to its nearest enemy $z$.

Figure 1: Demonstration of the filtering rule used in the PIF algorithm.

The PIF algorithm is described in Algorithm 2. The algorithm contains the
parameter $m$, which determines the smallest size of the subsets to which the
filtering rule (1) is applied.

Algorithm 2 Parallel Instance Filtering Algorithm

0: $T$ \- original training set , $m$ \- minimal size of a subset

0: reduced training set

1: perform Wilson Editing noise-filtering procedure for $T$

2: for all points $x$ from $T$ do

3: compute nearest enemy $NE_{x}$

4: compute a subset $S_{NE_{x}}$

5: end for

6: for all nearest enemies $NE$ do

7: if $|S_{NE}|\geq m$ then

8: for all points $y$ from $S_{NE}$ do

9: find $x\neq y$ in $S_{NE}$ such that
$\mathcal{D}(y,NE)\geq\max\\{\mathcal{D}(y,x),\mathcal{D}(x,NE)\\}$

10: if such $x$ was found then

11: remove $y$ from $T$

12: end if

13: end for

14: end if

15: end for

16: return $T$

From the implementation point of view, while we compute all-to-all distances
and find $k$ nearest neighbors for each instance $x$, we also save all nearest
enemies, and for each enemy, $NE_{x}$, create subset $S_{NE_{x}}$ of instances
having $NE_{x}$ as its nearest enemy.

The PIF algorithm runs in parallel since each of the following parts of the
algorithm can be implemented in a parallel way:

  * •

finding $k$ nearest neighbors, and all nearest enemies $NE$ and as a result,
computing subsets $S_{NE}$ of instances corresponding to $NE$

  * •

applying KNN classifier used in the Wilson Editing noise-filtering procedure

  * •

filtering out instances for each subset $S_{NE}$ independently according to
the rule (1).

Fig. 2 demonstrates the PIF algorithm for the data set that consists of the
four disjoint subsets.

(a) Original data set.

(b) Disjoint subsets.

(c) Reduced data set.

Figure 2: Demonstration of the PIF algorithm for a training data set
consisting of four disjoint subsets. The nearest enemies are highlighted in
squares.

##  IV Experimental Setup

The data set used in our experiments contains real-world data from 500,000
Windows programs in the PE file format, where half are malicious and half are
benign programs. The malicious and benign programs were obtained from the
industrial partner’s laboratory, and the open-access Virusshare repository
[28].

This work is based on static analysis, which aims to search for information
about the structure and data in the file without actually running the program.
The features used in our work are metadata from the PE file format [5], which
is the most widely used file format for malware samples for personal
computers. A PE file consists of headers and sections that encapsulate the
information necessary to manage the executable code. To classify an executable
file in the PE format, we extract static format information and translate it
into a feature vector suitable for classification. To extract features from
the PE file format, we used Python module `pefile` [29]. This module extracts
all PE file features into an object from which they can be easily accessed. In
total, we extracted 370 features based on static information only, i.e.,
without running the program. Nominal features were transformed into numeric
values, and all numeric values were normalized using min-max normalization. We
then select the 75 most relevant features for distinguishing between malicious
and benign files using the Recursive Feature Elimination for Logistic
Regression algorithm, where both methods are implemented in the Scikit-learn
library [30]. A detailed description of the preprocessing of features can be
found in our previous work [31].

In all experiments, the parameter $m$ of the PIF algorithm was set to 2. As a
result, the filtering rule (1) was applied to any possible subsets.

The performance of instance selection algorithms on the test set is measured
using the following standard methods. The most intuitive and commonly used
evaluation metric in machine learning is accuracy (ACC). It is defined on a
given test set as the percentage of correctly classified instances. We
evaluated instance selection algorithms using the KNN classifier. The authors
of the DROP family methods recommended to use a small odd number of nearest
neighbors, $k$, such as 1, 3, or 5. In our experiments, we set the $k=3$.

The second measure is a storage percentage (R). It shows what percent of the
original (non-reduced) training set was retained by the instance selection
algorithm.

Some instance selection algorithms outperform others in terms of storage
percentage, while some instance selection algorithms outperform others in
terms of the accuracy of the KNN classifier applied to the reduced data set.
Therefore, we also consider the ratio between average accuracy and storage
percentage. Our experiments presented in the following section demonstrate
that such a ratio was the highest for the PIF algorithm applied to large data
sets.

##  V Experimental Results

In this section, we present several experiments where we compared the PIF
algorithm with existing instance selection algorithms for different data
sizes. All experiments in this work were executed on a single computer
platform having two processors (Intel Xeon Gold 6136, 3.0GHz, 12 cores each),
with 64 GB of RAM running the Ubuntu server 18.04 LTS operating system.

All experiments presented in this paper were repeated 20 times for randomly
chosen training and test data sets from a total set of 500,000 instances. We
kept the ratio between the size of the training set and the size of the test
set at 80:20. The results in all tables and figures show the average values of
storage percentage and accuracy.

Eight different data set sizes were considered for the evaluation. We divided
them into two categories:

  * •

medium data sets: 5K, 10K, 20K, 50K, and 100K of samples,

  * •

large data sets: 200K, 300K, and 400K of samples,

where the capital letter K represents times one thousand (e.g., 100K =
100,000).

###  V-A Evaluation on medium data sets

A summary of our experiment for medium size data sets is provided in Table I.
The KNN algorithm that retains 100 % of the training set is also included for
comparison. Table I demonstrates that when the size of data sets decreases,
then classification accuracy also decreases.

TABLE I: Accuracy and storage percentage represented in %. The results presented in bold represent the highest accuracy and the lowest storage percentage for the data sets. | KNN | CNN | DROP3 | MSS | ICF | PIF
---|---|---|---|---|---|---
size | ACC | R | ACC | R | ACC | R | ACC | R | ACC | R | ACC | R
5K | 92.72 | 100 | 90.64 | 17.94 | 88.64 | 13.70 | 91.28 | 18.9 | 84.72 | 21.7 | 91.52 | 16.2
10K | 93.04 | 100 | 91.80 | 15.21 | 90.16 | 10.90 | 92.72 | 16.1 | 90.04 | 17.7 | 91.84 | 13.39
20K | 94.50 | 100 | 93.12 | 12.73 | 92.46 | 8.44 | 93.20 | 13.7 | 91.10 | 17.7 | 93.20 | 11.62
50K | 95.98 | 100 | 95.29 | 10.24 | 93.22 | 6.74 | 94.65 | 11.2 | 92.69 | 18.3 | 94.25 | 8.74
100K | 96.46 | 100 | 95.51 | 8.75 | 94.71 | 5.69 | 95.88 | 9.85 | 92.77 | 17.4 | 95.63 | 7.81

DROP 3 achieved the lowest storage percentage for all data sets sizes, while
the PIF algorithm achieved the second-lowest storage percentage. However, in
terms of accuracy, DROP3 achieved the second-worst classification results. The
PIF algorithm achieved the highest average accuracy for data sets with 5,000
and 20,000 samples, while it achieved the second-highest accuracy for the 10K
and the 100K data sets.

###  V-B Evaluation on large data sets

This section summarizes the results for large data sets. The largest data set
for which we evaluated all instance selection algorithms used in this work has
100,000 samples (i.e., the 100K data set). The DROP3 reached the highest
computing time on this data set, exceeding 24 hours. Since the computation
time of the state-of-the-art instance selection methods used in this work was
too high for large data sets, we used a stratified strategy.

Since the PIF algorithm can process individual subsets in parallel, it is
suitable for processing also large sets. However, the experiments also contain
the results of the PIF algorithm for the data set to which the stratification
was applied. A number of subsets into which the data set is divided is given
as a parameter to the stratification algorithm. We considered the following
values for the parameter: 200, 400, 600, 800, 1000, 1200, and 1400. For the
value 1000, we achieved the best ratio between the classification accuracy and
storage percentage. As a result, we divide each data set of size $n$ into
$n/1000$ disjoint subsets. The results using stratification are shown in Table
II.

TABLE II: Accuracy and storage percentage represented in %. The results presented in bold represent the highest accuracy and the lowest storage percentage for the data sets. The postfix _s in the name of the instance selection algorithm means that the stratification strategy was used. | KNN | CNN_s | DROP3_s | MSS_s | ICF_s | PIF_s | PIF
---|---|---|---|---|---|---|---
size | ACC | R | ACC | R | ACC | R | ACC | R | ACC | R | ACC | R | ACC | R
100K | 96.46 | 100 | 93.70 | 7.67 | 93.76 | 13.91 | 95.62 | 21.71 | 93.93 | 23.60 | 94.40 | 15.87 | 95.58 | 7.81
200K | 96.80 | 100 | 94.61 | 6.68 | 94.53 | 12.12 | 95.95 | 18.41 | 94.67 | 22.61 | 95.10 | 13.82 | 96.00 | 6.73
300K | 97.12 | 100 | 95.32 | 6.04 | 95.25 | 10.96 | 96.20 | 16.92 | 95.11 | 22.21 | 95.64 | 12.73 | 96.52 | 6.11
400K | 97.23 | 100 | 95.28 | 5.67 | 95.43 | 10.11 | 96.32 | 15.88 | 95.17 | 19.32 | 95.76 | 12.10 | 96.61 | 5.73

The PIF algorithm achieved the highest average accuracy for all sizes except
100K and the second-lowest storage percentage for all data sets. While CNN
using a stratified strategy achieved the lowest storage percentage, it also
achieved the lowest accuracy for the 100K data set, the second-lowest accuracy
for the 200K and 400K data set, and the third-lowest accuracy for the 300K
data set.

For a data set with 100K samples, we can compare the accuracy and storage
percentages of instance selection algorithms without stratification (see Tab.
I) and when stratification was used (see Tab. II). All instance selection
algorithms, except the ICF, achieved higher accuracy when stratification was
not used. Regarding storage percentage, only DROP3 and MSS achieved lower
storage percentage when stratification was not used.

Figures 3 and 4 illustrate the performance of the PIF algorithm for medium-
sized data sets in terms of the storage percentage and the accuracy,
respectively. The figures compare the results with the performance of the
instance selection algorithms used in our experiments.

Figure 3: Comparison of storage percentage of the PIF algorithm with the
selected state-of-the-art instance selection algorithms. Figure 4: Comparison
of accuracy percentage of the PIF algorithm with the selected state-of-the-art
instance selection algorithms. The KNN classifier was trained using the
original (non-reduced) training data set, and all the remaining algorithms
were trained using reduced training sets.

Figures 5 and 6 demonstrate the relation between the storage percentage and
the accuracy for medium-sized data sets and for large-sized data sets
respectively. Fig. 5 represents a five instance selection algorithm as an
oriented polyline connecting four points that correspond (from left to right)
to the following data set’s sizes: 10K, 20K, 50K, and 100K. Fig. 6 represents
the five instance selection algorithm using stratification and the PIF
algorithm without stratification. Similarly, the instance selection algorithms
are represented as an oriented polyline connecting four points that correspond
(from left to right) to the following data set’s sizes: 100K, 200K, 300K, and
400K. The figures demonstrate that the PIF algorithm achieved the results of
the state-of-the-art instance selection algorithm. In addition, the PIF
algorithm achieved the highest ratio between average accuracy and storage
percentage for large-sized data sets.

Figure 5: Relation between the reduction (i.e., storage percentage) and the
accuracy percentage. The results were obtained using the data set of sizes
10K, 20K, 50K, and 100K of samples. Figure 6: Relation between the reduction
(i.e., storage percentage) and the accuracy percentage. The results were
obtained for the data set of sizes: 100K, 200K, 300K, and 400K of samples.

Our implementation of the PIF algorithm reduced the 400K data set in 2 hours
and 31 minutes on average, while the computational times of all other instance
selection algorithms considered in this work exceeded 24 hours. One of the
reasons for such a significant difference among computational times is that
the PIF algorithm runs fully in parallel. In contrast, the other instance
selection algorithms run in parallel only partly (typically, computing one-to-
one distances among instances runs in parallel).

##  VI Conclusion

Antivirus vendors have very large data sets intended for training machine
learning algorithms. As a result, the training process becomes more and more
expensive. Instance selection algorithms deal with this problem by removing
redundant and noise instances, and they were applied to data sets from
different domains. In this paper, we examined the performance of selected
instance selection algorithms for the problem of malware detection. We
proposed a novel instance selection algorithm called Parallel Instance
Filtering (PIF) that splits the training data set into disjoint subsets
according to the nearest enemies and applies a filtering rule to each subset
independently. Our algorithm is easy to implement, runs in parallel, and can
significantly reduce training sets with only a small reduction in accuracy.

Several experiments were conducted on the medium and large data sets
containing metadata from the portable executable file format. For a large
training data set consisting of 400,000 samples, the PIF algorithm achieved a
storage percentage of 5.90%, and the accuracy using the non-reduced data set,
97.23%, was decreased to 96.71% using the reduced data set. Experimental
results for large data sets showed that PIF outperformed the state-of-the-art
methods considered in this work in terms of the ratio between the average
accuracy and storage percentage.

In future work, we plan to experiment with different filter rules for the PIF
algorithm and also perform extended benchmark analysis for data sets from
different domains.

## References

  * [1] D. Ucci, L. Aniello, and R. Baldoni, “Survey of machine learning techniques for malware analysis,” _Computers & Security_, vol. 81, pp. 123–147, 2019\.
  * [2] AV-TEST, “Av-test malware statistics,” https://www.av-test.org/en/statistics/malware/, 2022, [Online; accessed 22-June-2022].
  * [3] J. A. Olvera-López, J. A. Carrasco-Ochoa, J. F. Martínez-Trinidad, and J. Kittler, “A review of instance selection methods,” _Artificial Intelligence Review_ , vol. 34, no. 2, pp. 133–143, 2010.
  * [4] C. García-Osorio, A. de Haro-García, and N. García-Pedrajas, “Democratic instance selection: A linear complexity instance selection algorithm based on classifier ensemble concepts,” _Artificial Intelligence_ , vol. 174, no. 5-6, pp. 410–441, 2010.
  * [5] Microsoft, “Pe format - win32 apps,” [Online; accessed 22-June-2022], Available: https://docs.microsoft.com/en-us/windows/win32/debug/pe-format.
  * [6] K. Monnappa, _Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware_. Packt Publishing Ltd, 2018.
  * [7] J. O. Kephart and W. C. Arnold, “Automatic extraction of computer virus signatures,” in _4th virus bulletin international conference_ , 1994, pp. 178–184.
  * [8] H. V. Nath and B. M. Mehtre, “Static malware analysis using machine learning methods,” in _International Conference on Security in Computer Networks and Distributed Systems_. Springer, 2014, pp. 440–450.
  * [9] O. Or-Meir, N. Nissim, Y. Elovici, and L. Rokach, “Dynamic malware analysis in the modern era—a state of the art survey,” _ACM Computing Surveys (CSUR)_ , vol. 52, no. 5, p. 88, 2019.
  * [10] E. Raff and C. Nicholas, “A survey of machine learning methods and challenges for windows malware classification,” _arXiv preprint arXiv:2006.09271_ , 2020\.
  * [11] A. Afianian, S. Niksefat, B. Sadeghiyan, and D. Baptiste, “Malware dynamic analysis evasion techniques: A survey,” _ACM Computing Surveys (CSUR)_ , vol. 52, no. 6, pp. 1–28, 2019.
  * [12] A. Damodaran, F. Di Troia, C. A. Visaggio, T. H. Austin, and M. Stamp, “A comparison of static, dynamic, and hybrid analysis for malware detection,” _Journal of Computer Virology and Hacking Techniques_ , vol. 13, no. 1, pp. 1–12, 2017.
  * [13] S. Garcia, J. Derrac, J. Cano, and F. Herrera, “Prototype selection for nearest neighbor classification: Taxonomy and empirical study,” _IEEE transactions on pattern analysis and machine intelligence_ , vol. 34, no. 3, pp. 417–435, 2012.
  * [14] H. Brighton and C. Mellish, “Advances in instance selection for instance-based learning algorithms,” _Data mining and knowledge discovery_ , vol. 6, no. 2, pp. 153–172, 2002.
  * [15] J. R. Cano, F. Herrera, and M. Lozano, “Stratification for scaling up evolutionary prototype selection,” _Pattern Recognition Letters_ , vol. 26, no. 7, pp. 953–963, 2005.
  * [16] T. Cover and P. Hart, “Nearest neighbor pattern classification,” _IEEE transactions on information theory_ , vol. 13, no. 1, pp. 21–27, 1967.
  * [17] D. L. Wilson, “Asymptotic properties of nearest neighbor rules using edited data,” _IEEE Transactions on Systems, Man, and Cybernetics_ , no. 3, pp. 408–421, 1972.
  * [18] D. R. Wilson and T. R. Martinez, “Instance pruning techniques,” in _ICML_ , vol. 97, 1997, pp. 403–411.
  * [19] D. R. Wilson and T. R. Martinez, “Reduction techniques for instance-based learning algorithms,” _Machine learning_ , vol. 38, no. 3, pp. 257–286, 2000\.
  * [20] H. Brighton and C. Mellish, “On the consistency of information filters for lazy learning algorithms,” in _European conference on principles of data mining and knowledge discovery_. Springer, 1999, pp. 283–288.
  * [21] R. Barandela, F. J. Ferri, and J. S. Sánchez, “Decision boundary preserving prototype selection for nearest neighbor classification,” _International Journal of Pattern Recognition and Artificial Intelligence_ , vol. 19, no. 06, pp. 787–806, 2005.
  * [22] J. Dean and S. Ghemawat, “Mapreduce: simplified data processing on large clusters,” _Communications of the ACM_ , vol. 51, no. 1, pp. 107–113, 2008\.
  * [23] I. Triguero, D. Peralta, J. Bacardit, S. García, and F. Herrera, “Mrpr: A mapreduce solution for prototype reduction in big data classification,” _neurocomputing_ , vol. 150, pp. 331–345, 2015.
  * [24] P. Indyk and R. Motwani, “Approximate nearest neighbors: towards removing the curse of dimensionality,” in _Proceedings of the thirtieth annual ACM symposium on Theory of computing_. ACM, 1998, pp. 604–613.
  * [25] A. Andoni and P. Indyk, “Near-optimal hashing algorithms for approximate nearest neighbor in high dimensions,” in _2006 47th annual IEEE symposium on foundations of computer science (FOCS’06)_. IEEE, 2006, pp. 459–468.
  * [26] Á. Arnaiz-González, J.-F. Díez-Pastor, J. J. Rodríguez, and C. García-Osorio, “Instance selection of linear complexity for big data,” _Knowledge-Based Systems_ , vol. 107, pp. 83–95, 2016.
  * [27] D. Asimov, “The grand tour: a tool for viewing multidimensional data,” _SIAM journal on scientific and statistical computing_ , vol. 6, no. 1, pp. 128–143, 1985.
  * [28] VirusShare, “[online; accessed 22-june-2022],” Available: http://virusshare.com.
  * [29] E. Carrera, “Pefile,” [Online; accessed 22-June-2022], Available: https://github.com/erocarrera/pefile.
  * [30] Scikit-learn, “[online; accessed 22-june-2022],” Available: {https://scikit-learn.org}.
  * [31] M. Jureček and R. Lórencz, “Application of distance metric learning to automated malware detection,” _IEEE Access_ , vol. 9, pp. 96 151–96 165, 2021.