Deep Learning Model with Sequential Features for Malware Classification

Wu, Xuan Hui; Song, Yafei; Hou, Xiaoyi; Ma, Zexuan; Chen, Chen

doi:10.3390/app12199994

Cited by 4 publications

(2 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For the Malware identification phase, STCN is compared with two traditional statistical learning methods, that is, SVM and LR and some other advanced CE‐optimised neural networks, that is, long short‐term memory (LSTM), gated recurrent unit (GRU), TCN, and TCN with bidirectional GRU (TCN‐BiGRU). Hence, the specific benchmarks in this study include unigram‐based SVM, unigram‐based LR, Word2Vec‐based GRU, Word2Vec‐based LSTM [24], Word2Vec‐based TCN [18], and Word2Vec‐based TCN‐BiGRU [25]. In this study, the experiments are conducted on an NVIDIA GPU and implemented by Python with several extended libraries.…”

Section: Resultsmentioning

confidence: 99%

Robust Malware identification via deep temporal convolutional network with symmetric cross entropy learning

et al. 2023

View full text Add to dashboard Cite

Recent developments in the field of Internet of things (IoT) have aroused growing attention to the security of smart devices. Specifically, there is an increasing number of malicious software (Malware) on IoT systems. Nowadays, researchers have made many efforts concerning supervised machine learning methods to identify malicious attacks. High-quality labels are of great importance for supervised machine learning, but noises widely exist due to the non-deterministic production environment. Therefore, learning from noisy labels is significant for machine learning-enabled Malware identification. In this study, motivated by the symmetric cross entropy with satisfactory noise robustness, the authors propose a robust Malware identification method using temporal convolutional network (TCN). Moreover, word embedding techniques are generally utilised to understand the contextual relationship between the input operation code (opcode) and application programming interface function names. Here, considering the numerous unlabelled samples in real-world intelligent environments, the authors pre-train the TCN model on an unlabelled set using a word embedding method, that is, Word2Vec. In the experiments, the proposed method is compared with several traditional statistical methods and more recent neural networks on a synthetic Malware dataset and a realworld dataset. The performance comparisons demonstrate the better performance and noise robustness of their proposed method, especially that the proposed method can yield the best identification accuracy of 98.75% in real-world scenarios.

show abstract

Section: Resultsmentioning

confidence: 99%

Robust Malware identification via deep temporal convolutional network with symmetric cross entropy learning

et al. 2023

View full text Add to dashboard Cite

show abstract

“…In order to evaluate the performance of the classification model, the model was compared with the model method proposed in [8,[37][38][39][40][41][42][43][44][45][46]. The data sets used in these documents are the same as those in this paper.…”

Section: Comparison Of Different Classification Algorithmsmentioning

confidence: 99%

An Efficient Malware Classification Method Based on the AIFS-IDL and Multi-Feature Fusion

Song

2022

Information

Self Cite

View full text Add to dashboard Cite

In recent years, the presence of malware has been growing exponentially, resulting in enormous demand for efficient malware classification methods. However, the existing machine learning-based classifiers have high false positive rates and cannot effectively classify malware variants, packers, and obfuscation. To address this shortcoming, this paper proposes an efficient deep learning-based method named AIFS-IDL (Atanassov Intuitionistic Fuzzy Sets-Integrated Deep Learning), which uses static features to classify malware. The proposed method first extracts six types of features from the disassembly and byte files and then fuses them to solve the single-feature problem in traditional classification methods. Next, Atanassov’s intuitionistic fuzzy set-based method is used to integrate the result of the three deep learning models, namely, GRU (Temporal Convolutional Network), TCN (Temporal Convolutional Network), and CNN (Convolutional Neural Networks), which improves the classification accuracy and generalizability of the classification model. The proposed method is verified by experiments and the results show that the proposed method can effectively improve the accuracy of malware classification compared to the existing methods. Experiments were carried out on the six types of features of malicious code and compared with traditional classification algorithms and ensemble learning algorithms. A variety of comparative experiments show that the classification accuracy rate of integrating multi-feature, multi-model aspects can reach 99.92%. The results show that, compared with other static classification methods, this method has better malware identification and classification ability.

show abstract