Abstract:Conventional malware detection approaches have the overhead of feature extraction, the requirement of domain experts, and are time-consuming and resource-intensive. Learning-based approaches are the mainstay of malware detection as they overcome most of these challenges by significantly improving the detection effectiveness and providing a low false positive rate. The exponential growth of malware variants and first-time-appeared malware, which includes polymorphic and zero-day attacks, are some of the significant challenges to learning-based malware detectors. These challenges have catastrophic impacts on the detection effectiveness of these learning-based malware detectors. This paper proposes a novel deep learning-based framework to detect first-time-appeared malware effectively and efficiently by providing better performance than conventional malware detection approaches. First, it translates and visualises each Windows portable executable (PE) file into a coloured image to eliminate the overhead of feature extraction and the need for domain experts to analyse the features. In the subsequent step, a fine-tuned deep learning model is used to extract the deep features from the last fully connected layer. The step has reduced the cost of training required by the deep learning models if used for end-to-end classification. The third step selects the most important and influential features through a powerful feature selection algorithm. The most important features are then fed to a one-class classifier for final detection. With the one-class classifier, an enclosed boundary around the features of benign data is constructed. Anything outside the boundary is declared as an anomaly/malicious. It has enhanced the framework's ability to detect evolving, unseen, polymorphic, and zero-day attacks, as well as reducing the problem of overfitting. The detection effectiveness of the proposed framework is validated with state-of-the-art deep learning models and conventional approaches. The proposed framework has outperformed with an accuracy of 99.30% on the Malimg dataset. The Wilcoxon signed-rank test is used to validate the statistical significance of the proposed framework. It is evident from the results that the proposed framework is effective and can be used in the defence industry, resulting in more powerful and robust solutions against zero-day and polymorphic attacks.

A Novel Approach towards Windows Malware Detection System Using Deep Neural Networks

NIDS: Neural Network Based Intrusion Detection System

Malware Analysis Using Machine Learning and Deep Learning Techniques

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

A Novel Malware Detection System Based On Machine Learning and Binary Visualization

A Unique Approach to Malware Detection Using Deep Convolutional Neural Networks

An investigation of a deep learning based malware detection system

Robust Intelligent Malware Detection Using Deep Learning

Hybrid Deep Learning Approach Based on LSTM and CNN for Malware Detection

A Novel Android Malware Detection Approach Based on Convolutional Neural Network.

EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls

A novel machine learning approach for detecting first-time-appeared malware

Artificial Intelligence-Based Malware Detection, Analysis, and Mitigation

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Malware Threat Detection using Deep Neural Networks

Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features

NtMalDetect: A Machine Learning Approach to Malware Detection Using Native API System Calls

Separating Malicious from Benign Software Using Deep Learning Algorithm

Deep Learning Models for Detecting Malware Attacks

A Survey of Malware Detection Using Deep Learning

A Novel Malware Detection Mechanism based on Features Extracted from Converted Malware Binary Images