Abstract:Malware open-set recognition (MOSR) is an emerging research domain that aims at jointly classifying malware samples from known families and detecting the ones from novel unknown families, respectively. Existing works mostly rely on a well-trained classifier considering the predicted probabilities of each known family with a threshold-based detection to achieve the MOSR. However, our observation reveals that the feature distributions of malware samples are extremely similar to each other even between known and unknown families. Thus, the obtained classifier may produce overly high probabilities of testing unknown samples toward known families and degrade the model performance. In this article, we propose the multi \ modal dual-embedding networks, dubbed MDENet, to take advantage of comprehensive malware features from different modalities to enhance the diversity of malware feature space, which is more representative and discriminative for down-stream recognition. Concretely, we first generate a malware image for each observed sample based on their numeric features using our proposed numeric encoder with a re-designed multiscale CNN structure, which can better explore their statistical and spatial correlations. Besides, we propose to organize tokenized malware features into a sentence for each sample considering its behaviors and dynamics, and utilize language models as the textual encoder to transform it into a representable and computable textual vector. Such parallel multimodal encoders can fuse the above two components to enhance the feature diversity. Last, to further guarantee the open-set recognition (OSR), we dually embed the fused multimodal representation into one primary space and an associated sub-space, i.e., discriminative and exclusive spaces, with contrastive sampling and ρ -bounded enclosing sphere regularizations, which resort to classification and detection, respectively. Moreover, we also enrich our previously proposed large-scaled malware dataset MAL-100 with multimodal characteristics and contribute an improved version dubbed MAL-100 + . Experimental results on the widely used malware dataset Mailing and the proposed MAL-100 + demonstrate the effectiveness of our method.

Opening Deep Neural Networks with Generative Models

Convolutional Prototype Network for Open Set Recognition

Class-Specific Semantic Reconstruction for Open Set Recognition

Exploring Sparse MoE in GANs for Text-conditioned Image Synthesis.

On the link between generative semi-supervised learning and generative open-set recognition

P-ODN: Prototype based Open Deep Network for Open Set Recognition

Learning Multiple Gaussian Prototypes for Open-Set Recognition

A Prototypical Metric Learning Approach for Open-Set Semantic Segmentation on Remote Sensing Images

Graph Open-Set Recognition Via Entropy Message Passing

Exploring Diverse Representations for Open Set Recognition

Multimodal Dual-Embedding Networks for Malware Open-Set Recognition

Open-Set Face Recognition with Maximal Entropy and Objectosphere Loss

MORGAN: Meta-Learning-based Few-Shot Open-Set Recognition via Generative Adversarial Network

Open-set Adversarial Defense

A comparative study of generative adversarial networks for image recognition algorithms based on deep learning and traditional methods

GMMSeg: Gaussian Mixture based Generative Semantic Segmentation Models

An Encoder Generative Adversarial Network for Multi-modality Image Recognition

Conditional Gaussian Distribution Learning for Open Set Recognition

MDENet: Multi-modal Dual-embedding Networks for Malware Open-set Recognition

Open-set Face Recognition for Small Galleries Using Siamese Networks

Benchmarking and Analyzing Generative Data for Visual Recognition