Deep Learning Model with Sequential Features for Malware Classification
Source abstract
Abstract
Currently, malware shows an explosive growth trend. Demand for classifying malware is also increasing. The problem is the low accuracy of both malware detection and classification. From the static features of malicious families, a new deep learning method of TCN-BiGRU was proposed in this study, which combined temporal convolutional network (TCN) and bidirectional gated recurrent unit (BiGRU). First, we extracted the features of malware assembly code sequences and byte code sequences. Second, we shortened the opcode sequences by TCN to explore the features in the data and then used the BiGRU network to capture the opcode sequences in both directions to achieve deep extraction of the features of the opcode sequences. Finally, the fully connected and softmax layers were used to output predictions of the deep features. Multiple comparisons and ablation experiments demonstrated that the accuracy of malware detection and classification were effectively improved by our method. Our overall performance was 99.72% for samples comprising nine different classes, and our overall performance was 96.54% for samples comprising two different classes.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Air and Missile Defense, Air Force Engineering University, Xi’an 710051, China
Funding
National Science Foundation of China · National Science Foundation of Shaanxi Provence · Young Talent fund of the University and Association for Science and Technology in Shaanxi, China · Innovation Capability Support Plan of Shaanxi, China
References (31)
Show source-provided references
1. Zhao, J., Zhang, S., Liu, B., and Cui, B. (2018, January 11). Malware detection using machine learning based on the combination of dynamic and static features. Proceedings of the 27th International Conference on Computer Communication and Networks (ICCCN), Hangzhou, China.10.1109/ICCCN.2018.8487459 ↗
2. Research on malware detection based on vector features of assembly instructions
3. Raff, E., Sylvester, J., and Nicholas, C. (2017). Learning the pe header, malware detection with minimal domain knowledge. Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, Association for Computing Machinery.10.1145/3128572.3140442 ↗
4. Zhao, S., Ma, X., Zou, W., and Bai, B. (2019). DeepCG: Classifying metamorphic malware through deep learning of call graphs. Proceedings of the International Conference on Security and Privacy in Communication Systems, Springer.10.1007/978-3-030-37228-6_9 ↗
5. Opcode sequences as representation of executables for data-mining-based unknown malware detection10.1016/j.ins.2011.08.020 ↗
6. Kang, B., Yerima, S.Y., McLaughlin, K., and Sezer, S. (2016, January 9). N-opcode Analysis for Android Malware Classification and Categorization. Proceedings of the 2016 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), London, UK.10.1109/CyberSecPODS.2016.7502343 ↗
7. Pascanu, R., Stokes, J.W., Sanossian, H., Marinescu, M., and Thomas, A. (2015, January 19–24). Malware classification with recurrent networks. Proceedings of the 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), South Brisbane, QLD, Australia.10.1109/ICASSP.2015.7178304 ↗
8. Kwon, I., and Im, E.G. (2017). Extracting the Representative API Call Patterns of Malware Families Using Recurrent Neural Network. Proceedings of the International Conference on Research in Adaptive and Convergent Systems, Association for Computing Machinery.10.1145/3129676.3129712 ↗
9. Messay-Kebede, T., Narayanan, B.N., and Djaneye-Boundjou, O. (2018, January 23–26). Combination of Traditional and Deep Learning based Architectures to Overcome Class Imbalance and its Application to Malware Classification. Proceedings of the NAECON 2018-IEEE National Aerospace and Electronics Conference, Dayton, OH, USA.10.1109/NAECON.2018.8556722 ↗
10. Gibert, D., Mateu, C., and Planes, J. (2020, January 19–24). Orthrus: A Bimodal Learning Architecture for Malware Classification. Proceedings of the 2020 International Joint Conference on Neural Networks (IJCNN), Glasgow, UK.10.1109/IJCNN48605.2020.9206671 ↗
11. Detecting malware with an ensemble method based on deep neural network10.1155/2018/7247095 ↗
12. Narayanan, B.N., and Davuluru, V.S.P. (2021). Ensemble Malware Classification System Using Deep Neural Networks. Electronics, 9.10.3390/electronics9050721 ↗
13. Ahmadi, M., Ulyanov, D., Semenov, S., Trofimov, M., and Giacinto, G. (2016). Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification. Proceedings of the 6th ACM Conference on Data and Application Security and Privacy, Association for Computing Machinery.10.1145/2857705.2857713 ↗
14. Zhang, Y., Huang, Q., Ma, X., Yang, Z., and Jiang, J. (2016, January 23–26). Using Multi-features and Ensemble Learning Method for Imbalanced Malware Classification. Proceedings of the 2016 IEEE Trustcom/BigDataSE/ISPA, Tianjin, China.10.1109/TrustCom.2016.0163 ↗
15. Improving malware detection using multiview ensemble learning10.1002/sec.1600 ↗
16. Bai, S., Kolter, J.Z., and Koltun, V. (2018). An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv.
17. Classification of Field Moving Targets Based on Improved TCN Network
18. Fault Diagn-osis for Power Converters Based on Optimized Temporal Convolutional Network10.1109/TIM.2020.3021110 ↗
19. Huang, Q., and Hain, T. (2021, January 6–11). Improving Audio Anomalies Recognition Using Temporal Convolutional Attention Network. Proceedings of the ICASSP 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Toronto, ON, Canada.10.1109/ICASSP39728.2021.9414611 ↗
20. Short-term prediction for wind power based on temporal convolutional network10.1016/j.egyr.2020.11.219 ↗
21. Xu, Z., Zeng, W., Chu, X., and Cao, P. (2021). Multi-Aircraft Trajectory Collaborative Prediction Based on Social Long Short-Term Memory Network. Aerospace, 8.10.3390/aerospace8040115 ↗
22. Liu, Y., Ma, J., Tao, Y., Shi, L., Wei, L., and Li, L. (January, January 29). Hybrid Neural Network Text Classification Combining TCN and GRU. Proceedings of the 2020 IEEE 23rd International Conference on Computational Science and Engineering (CSE), Guangzhou, China.10.1109/CSE50738.2020.00012 ↗
23. Emitter signal recognition based on improved CLDNN
24. Wang, Y., Liao, W.L., and Chang, Y.Q. (2018). Gated Recurrent Unit Network-Based Short-Term Photovo-ltaic Forecasting. Energies, 11.10.3390/en11082163 ↗
25. Qi An Xin Technology Research Institute (2021, November 11). DataCon: Multidomain Large-Scale Competition Open Data for Security Research. (In Chinese).
26. Burnaev, E., and Smolyakov, D. (2016, January 12–15). One-class SVM with privileged information and its application to malware detection. Proceedings of the 2016 IEEE 16th International Conference on Data Mining Workshops (ICDMW), Barcelona, Spain.10.1109/ICDMW.2016.0046 ↗
27. Narayanan, B.N., Djaneye-Boundjou, O., and Kebede, T.M. (2016, January 25–29). Performance analysis of machine learning and pattern recognition algorithms for malware classification. Proceedings of the 2016 IEEE National Aerospace and Electronics Conference (NAECON) and Ohio Innovation Summit (OIS), Dayton, OH, USA.10.1109/NAECON.2016.7856826 ↗
28. Polymorphic malware detection using sequence classifcation methods and ensembles: BioSTAR 2016 Recommended Submission10.1186/s13635-017-0055-6 ↗
29. Guo, H., Huang, S., and Zhang, M. (2020). Classification of malware variant based on ensemble learning. International Conference on Machine Learning for Cyber Security, Springer.10.1007/978-3-030-62223-7_11 ↗
30. Saadat, S., and Joseph Raymond, V. (2021). Malware classification using CNN-Xgboost model. Artificial Intelligence Techniques for Advanced Computing Applications, Springer.10.1007/978-981-15-5329-5_19 ↗
31. A method for feature extraction of malicious code based on probabilistic topic models