Abstract:Malware open-set recognition (MOSR) is an emerging research domain that aims at jointly classifying malware samples from known families and detecting the ones from novel unknown families, respectively. Existing works mostly rely on a well-trained classifier considering the predicted probabilities of each known family with a threshold-based detection to achieve the MOSR. However, our observation reveals that the feature distributions of malware samples are extremely similar to each other even between known and unknown families. Thus, the obtained classifier may produce overly high probabilities of testing unknown samples toward known families and degrade the model performance. In this article, we propose the multi \ modal dual-embedding networks, dubbed MDENet, to take advantage of comprehensive malware features from different modalities to enhance the diversity of malware feature space, which is more representative and discriminative for down-stream recognition. Concretely, we first generate a malware image for each observed sample based on their numeric features using our proposed numeric encoder with a re-designed multiscale CNN structure, which can better explore their statistical and spatial correlations. Besides, we propose to organize tokenized malware features into a sentence for each sample considering its behaviors and dynamics, and utilize language models as the textual encoder to transform it into a representable and computable textual vector. Such parallel multimodal encoders can fuse the above two components to enhance the feature diversity. Last, to further guarantee the open-set recognition (OSR), we dually embed the fused multimodal representation into one primary space and an associated sub-space, i.e., discriminative and exclusive spaces, with contrastive sampling and ρ -bounded enclosing sphere regularizations, which resort to classification and detection, respectively. Moreover, we also enrich our previously proposed large-scaled malware dataset MAL-100 with multimodal characteristics and contribute an improved version dubbed MAL-100 + . Experimental results on the widely used malware dataset Mailing and the proposed MAL-100 + demonstrate the effectiveness of our method.

MGEL: A Robust Malware Encrypted Traffic Detection Method Based on Ensemble Learning with Multi-grained Features

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Encrypted Malicious Traffic Detection Based on Ensemble Learning

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML

HMMED: A Multimodal Model with Separate Head and Payload Processing for Malicious Encrypted Traffic Detection

Semi-Supervised Encrypted Malicious Traffic Detection Based on Multimodal Traffic Characteristics

MDENet: Multi-modal Dual-embedding Networks for Malware Open-set Recognition

MFEMDroid: A Novel Malware Detection Framework Using Combined Multitype Features and Ensemble Modeling

Self-Supervised Learning Malware Traffic Classification Based On Masked Auto-Encoder

An Encrypted Malicious Traffic Detection System Based on Neural Network

Detecting Malware with an Ensemble Method Based on Deep Neural Network

MERLOT: A Distilled LLM-based Mixture-of-Experts Framework for Scalable Encrypted Traffic Classification

MCES: Multi-classifier Ensemble System for Malware Detection and Identification

Malicious Encrypted Traffic Features Extraction Model Based on Unsupervised Feature Adaptive Learning

SEdroid: A Robust Android Malware Detector Using Selective Ensemble Learning

MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning

Multimodal Dual-Embedding Networks for Malware Open-Set Recognition

Few-shot encrypted traffic classification via multi-task representation enhanced meta-learning

A Survey of Encrypted Malicious Traffic Detection*

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

A Stacking-Based Classification Approach to Android Malware Using Host-Level Encrypted Traffic