Abstract:Traditional malware detection systems based on signature-based detection methods cannot detect new and unseen malware. Moreover, conventional machine learning methods for malware detection have utilized features extracted through static program analysis or dynamic analysis, which requires code debugging and execution primarily through offline processing; hence not a scalable approach. This paper proposes a novel intelligent malware classification using a deep convolution neural network (IMCNN) in organizational networks enabled with Honeypots. Systematic customization of pre-trained convolutional neural networks(CNN) as a transfer learning and ensemble learning as a classification is presented to detect intelligent modern-day malware. Real-world malware samples are systematically labeled and visualized into grayscale images. Four cutting-edge deep CNN models - VGG16, VGG19, InceptionV3, and ResNet50, are trained on the ImageNet database ( ≥ 1 million) and fine-tuned as feature extractors along with a basic CNN model. Three strategies are designed for feature extraction and selection: Rectified linear unit (ReLU) fully connected layer embedded in a deep CNN model, principal component analysis (PCA), and singular value decomposition(SVD). Reduced sets of features are stacked and used to train k-nearest neighbor (k-NN), support vector machine (SVM), and random forest (RF) classifiers for predictions. Subsequently, the predictive probabilities of different machine-learned models are ensembled using a soft voting method for final classification. The proposed method is evaluated on MalImg datasets (9339 malware samples of 25 families) and real-world modern malware datasets (690 malware of 22 families). The experimental results reveal that despite using a reduced feature set, the IMCNN effectively detects malware with 99.36% test accuracy on unseen data for MalImg datasets and 92.11% for real-world malware. In addition, the proposed method is compared with several existing state-of-art malware detection models in terms of performance accuracy and found performing as the best. Experiments demonstrated that the proposed method is resilient to polymorphic code obfuscation used by the malware authors.

Enhanced Few-Shot Malware Traffic Classification via Integrating Knowledge Transfer With Neural Architecture Search

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

Malware Traffic Classification Using Domain Adaptation and Ladder Network for Secure Industrial Internet of Things

Classifying Malware Traffic Using Images and Deep Convolutional Neural Network

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.

Self-Supervised Learning Malware Traffic Classification Based On Masked Auto-Encoder

Towards Novel Malicious Packet Recognition: A Few-Shot Learning Approach

Few-Shot Malware Classification via Attention-Based Transductive Learning Network

Task-Aware Meta Learning-based Siamese Neural Network for Classifying Obfuscated Malware

Model-agnostic generation-enhanced technology for few-shot intrusion detection

IoT Malware Network Traffic Classification using Visual Representation and Deep Learning

Few-Shot Learning-Based Malicious IoT Traffic Detection with Prototypical Graph Neural Networks

Transfer Learning for Image-Based Malware Detection for IoT

A lightweight model design approach for few-shot malicious traffic classification

Visualized Malware Multi-Classification Framework Using Fine-Tuned CNN-Based Transfer Learning Models

Classifying attack traffic in IoT environments via few-shot learning

BSTFNet: An Encrypted Malicious Traffic Classification Method Integrating Global Semantic and Spatiotemporal Features

IoT Malware Classification Based on Lightweight Convolutional Neural Networks

Malware Detection for Internet of Things Using One-Class Classification

IMCNN:Intelligent Malware Classification using Deep Convolution Neural Networks as Transfer learning and ensemble learning in honeypot enabled organizational network

Malware Squid: A Novel IoT Malware Traffic Analysis Framework using Convolutional Neural Network and Binary Visualisation