Abstract:Criminals use malware to disrupt cyber-systems. The number of these malware-vulnerable systems is increasing quickly as common systems, such as vehicles, routers, and lightbulbs, become increasingly interconnected cyber-systems. To address the scale of this problem, analysts divide malware into classes and develop, for each class, a specialized defense. In this project we classified malware with machine learning. In particular, we used a supervised multi-class long short term memory (LSTM) model. We trained the algorithm with thousands of malware files annotated with class labels (the training set), and the algorithm learned patterns indicative of each class. We used disassembled malware files (provided by Microsoft) and separated the constituent data into parsed instructions, which look like human-readable machine code text, and raw bytes, which are hexadecimal values. We are interested in which format, text or hex, is more valuable as input for classification. To solve this, we investigated four cases: a text-only model, a hexadecimal-only model, a multi-input model using both text and hexadecimal inputs, and a model based on combining the individual results. We performed this investigation using the machine learning Python package Keras, which allows easily configurable deep learning architectures and training. We hoped to understand the trade-offs between the different formats. Due to the class imbalance in the data, we used multiple methods to compare the formats, using test accuracies, balanced accuracies (taking into account weights of classes), and an accuracy derived from tables of confusion. We found that the multi-input model, which allows learning on both input types simultaneously, resulted in the best performance. Our finding expedites malware classification research by providing researchers a suitable deep learning architecture to train a tailored version to their malware.

Analytical method of high-dimensional feature fusion for malware classification

A Deep Feature Fusion Method for Android Malware Detection

Deep Learning Fusion For Effective Malware Detection: Leveraging Visual Features

A Simhash-Based Integrative Features Extraction Algorithm for Malware Detection

Malware classification based on double byte feature encoding

Hybrid Malware Classification Method Using Segmentation-Based Fractal Texture Analysis and Deep Convolution Neural Network Features

Using a Fine-Grained Hybrid Feature for Malware Similarity Analysis.

Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification

Malicious Code Variant Identification Based on Multiscale Feature Fusion CNNs

A Hybrid Attention Network for Malware Detection Based on Multi-Feature Aligned and Fusion

Malware Visualization for Fine-Grained Classification

Fusion of deep learning based cyberattack detection and classification model for intelligent systems

A New Malware Classification Approach Based On Malware Dynamic Analysis

Meta-HFMD: A Hierarchical Feature Fusion Malware Detection Framework Via Multi-task Meta-learning

Binary File’s Visualization and Entropy Features Analysis Combined with Multiple Deep Learning Networks for Malware Classification

Malware Analysis Using Machine Learning and Deep Learning Techniques

Malware Family Classification Method Based on Static Feature Extraction

Malware Homology Determination Using Visualized Images and Feature Fusion.

A Novel Approach to Malicious Code Detection Using CNN-BiLSTM and Feature Fusion

A Malware Detection Method Based on Sandbox, Binary Instrumentation and Multidimensional Feature Extraction

Dynamic data fusion using multi-input models for malware classification