Random CapsNet forest model for imbalanced malware type classification task

Çayır, Aykut; Ünal, Uğur; Dağ, Hasan

doi:10.1016/j.cose.2020.102133

Cited by 31 publications

(17 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The results are shown in Table 5. These approaches include traditional classification approaches [55][56][57], CNN [58,59], ensemble model [48,60], deep forest model [61], and our proposed approaches. As observed in Table 5, MalCaps achieved comparable results to others, and achieved a higher detection rate and macro F1-score.…”

Section: Resultsmentioning

confidence: 99%

“…As for the cybersecurity field, there are only very few papers in literatures about capsule networks within the malware classification domain. Cayir et al, propose a Random CapsNet for imbalanced malware based on bootstrap aggregating methods [48]. Their RNCF on the dataset achieves a 99.56% accuracy, though an impressive accuracy result, there are arguably two limitations to this paper.…”

Section: Deep Learning Based Malware Detection Approachesmentioning

confidence: 86%

See 1 more Smart Citation

MalCaps: A Capsule Network Based Model for the Malware Classification

Zhang

Chen

et al. 2021

Processes

View full text Add to dashboard Cite

The research on malware detection enabled by deep learning has become a hot issue in the field of network security. The existing malware detection methods based on deep learning suffer from some issues, such as weak ability of deep feature extraction, relatively complex model, and insufficient ability of model generalization. Traditional deep learning architectures, such as convolutional neural networks (CNNs) variants, do not consider the spatial hierarchies between features, and lose some information on the precise position of a feature within the feature region, which is crucial for a malware file which has specific sections. In this paper, we draw on the idea of image classification in the field of computer vision and propose a novel malware detection method based on capsule network architecture with hyper-parameter optimized convolutional layers (MalCaps), which overcomes CNNs limitations by removing the need for a pooling layer and introduces capsule layers. Firstly, the malware is transformed into a grayscale image. Then, the dynamic routing-based capsule network is used to detect and classify the image. Without advanced feature extraction and with only a small number of labeled samples, the presented method is tested on an unbalanced Microsoft Malware Classification Challenge (MMCC) dataset and experimental results produce testing accuracy of 99.34%, improving on a number of traditional deep learning models posited in recent malware classification literature.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Deep Learning Based Malware Detection Approachesmentioning

confidence: 86%

MalCaps: A Capsule Network Based Model for the Malware Classification

Zhang

Chen

et al. 2021

Processes

View full text Add to dashboard Cite

show abstract

“…Khan et al [30] conducted an extensive analysis of transfer learning for malware classification using ResNet and GoogleNet with their data preparation pipeline and the top model. Resnet 18,34,50,101,152 achieved an accuracy of 83%, 86.51%, 86.62%, 85.94%, and 87.98%, respectively. The accuracy for GoogleNet was 84%.…”

Section: Related Workmentioning

confidence: 98%

“…The kernel-based ELM classifier was used for malware classification achieving 94.25% accuracy for the Malimg dataset. Çayır et al [50] adopted the ensemble model of capsule networks (CapsNet). Instead of complex CNN architectures and domain-specific feature engineering techniques, the CapsNet model employs simple architecture engineering.…”

Section: Related Workmentioning

confidence: 99%

Image-Based Malware Classification Using VGG19 Network and Spatial Convolutional Attention

et al. 2021

View full text Add to dashboard Cite

In recent years the amount of malware spreading through the internet and infecting computers and other communication devices has tremendously increased. To date, countless techniques and methodologies have been proposed to detect and neutralize these malicious agents. However, as new and automated malware generation techniques emerge, a lot of malware continues to be produced, which can bypass some state-of-the-art malware detection methods. Therefore, there is a need for the classification and detection of these adversarial agents that can compromise the security of people, organizations, and countless other forms of digital assets. In this paper, we propose a spatial attention and convolutional neural network (SACNN) based on deep learning framework for image-based classification of 25 well-known malware families with and without class balancing. Performance was evaluated on the Malimg benchmark dataset using precision, recall, specificity, precision, and F1 score on which our proposed model with class balancing reached 97.42%, 97.95%, 97.33%, 97.11%, and 97.32%. We also conducted experiments on SACNN with class balancing on benign class, also produced above 97%. The results indicate that our proposed model can be used for image-based malware detection with high performance, despite being simpler as compared to other available solutions.

show abstract

“…Unlike these type of ensemble models, Random Transformer Forest (RTF) is a bagging-based ensemble model inspired from the Random Forest (RF) machine learning model [53]. Similar to RF, using an ensemble of pre-trained transformer models is assumed to increase classification performance on highly imbalanced malware datasets rather than using a single pre-trained transformer model [54,55].…”

Section: Proposed Model: Random Transformer Forest (Rtf)mentioning

confidence: 99%

An Ensemble of Pre-trained Transformer Models For Imbalanced Multiclass Malware Classification

Demirkıran¹,

Çayır²,

Ünal³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Classification of malware families is crucial for a comprehensive understanding of how they can infect devices, computers, or systems. Hence, malware identification enables security researchers and incident responders to take precautions against malware and accelerate mitigation. API call sequences made by malware are widely utilized features by machine and deep learning models for malware classification as these sequences represent the behavior of malware. However, traditional machine and deep learning models remain incapable of capturing sequence relationships among API calls. Unlike traditional machine and deep learning models, the transformer-based models process the sequences in whole and learn relationships among API calls due to multi-head attention mechanisms and positional embeddings. Our experiments demonstrate that the transformer model with one transformer block layer surpass the performance of the widely used base architecture, LSTM. Moreover, BERT or CANINE, the pre-trained transformer models, outperforms in classifying highly imbalanced malware families according to evaluation metrics: F1-score and AUC score. Furthermore, our proposed bagging-based random transformer forest (RTF) model, an ensemble of BERT or CANINE, reaches the state-of-the-art evaluation scores on the three out of four datasets, specifically it captures a state-of-the-art F1-score of 0.6149 on one of the commonly used benchmark dataset.

show abstract

Random CapsNet forest model for imbalanced malware type classification task

Cited by 31 publications

References 18 publications

MalCaps: A Capsule Network Based Model for the Malware Classification

MalCaps: A Capsule Network Based Model for the Malware Classification

Image-Based Malware Classification Using VGG19 Network and Spatial Convolutional Attention

An Ensemble of Pre-trained Transformer Models For Imbalanced Multiclass Malware Classification

Contact Info

Product

Resources

About