Static malware clustering using enhanced deep embedding method

Abstract

Summary Malware refers to any software, programs, or files that are intentionally utilised to compromise the system and cause unexpected losses to end‐users such as economical losses or privacy breaches. The rapid growth of malware makes it impossible to keep up with its progress merely via human interventions or manual analysis. One of the challenges for the human‐oriented approaches is they will cause backlog and inability to keep up with the development traces of the malware. Hence, an efficient method is needed urgently to analyse effectively and identify accurately the malware in their domain. Malware clustering has been extensively studied in the machine learning area with regards to distance functions, grouping algorithm and cluster validation. A large number of research studies have been done via behavioral analysis for clustering to achieve high performance of malware detections. However, there is a trade‐off for better detection performance between behaviorial approaches and high computational forces. Up to date, little work focuses on the deep learning representations for malware clustering. Therefore, in this paper, we propose an enhanced deep embedded clustering method to facilitate an effective and efficient malware clustering process. The new method takes advantage of linear dimensionality reduction and a customised deep neural network to learn malware representations in an orthogonal space and performs cluster assignments. Our experimental results demonstrate that the proposed clustering model outperforms the traditional K‐means method with regards to the enhanced features using various auto‐encoder, pre‐trained weight and principle component analysis (PCA).

Editorial: Recent advances in machine learning for cybersecurity

“…However, the performance of clustering techniques highly relies on the orthogonality of the features, which is often not trivial for the malware analysis. Ng et al propose an enhanced deep‐embedded clustering method to facilitate an effective and efficient malware clustering process. That is, Ng et al train a deep learning model consisting of an autoencoder and an autodecoder along with the soft assignment to obtain orthogonal malware features.…”

“…Ng et al propose an enhanced deep‐embedded clustering method to facilitate an effective and efficient malware clustering process. That is, Ng et al train a deep learning model consisting of an autoencoder and an autodecoder along with the soft assignment to obtain orthogonal malware features. The associated experiments in the paper report a solid performance and indicate a promising future of this technique.…”

“…However, the performance of clustering techniques highly relies on the orthogonality of the features, which is often not trivial for the malware analysis. Ng et al4 propose an enhanced deep-embedded clustering method to facilitate an effective and efficient…”

Neighborhood rough set based multi‐label feature selection with label correlation

“…To date, various multi-label feature selection (MFS) methods have been proposed. 12,[19][20][21] Roughly, these methods can be divided into three categories: wrapper, 22,23 embedded, 24,25 and filter. 26,27 The wrapper approach relies on a predefined learning method to perform a heuristic search across all possible feature subsets.…”

PROUD-MAL: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable

“…The latter form of analysis requires execution of the malicious code [35] in a controlled setup, i.e., sandbox and is often slow, resource intensive and not suitable for the deployment in the production environment which are also discussed in by [22]. Moreover, due to geometric rise in zero-day malware, existing approaches have become less efficient for detection of zero-day attacks and there is a dire need of automated malware detection and classification system equipped with the machine learning techniques [9].The machine learning can be either supervised or unsupervised, i.e., supervised learning or discriminative deep architectures conducts the training over labelled data, i.e., classification, regression or predictive analytics whereas unsupervised learning or so called generative architectures draws inferences from datasets consisting of input data without labels [43].…”