Abstract:Conventional malware detection approaches have the overhead of feature extraction, the requirement of domain experts, and are time-consuming and resource-intensive. Learning-based approaches are the mainstay of malware detection as they overcome most of these challenges by significantly improving the detection effectiveness and providing a low false positive rate. The exponential growth of malware variants and first-time-appeared malware, which includes polymorphic and zero-day attacks, are some of the significant challenges to learning-based malware detectors. These challenges have catastrophic impacts on the detection effectiveness of these learning-based malware detectors. This paper proposes a novel deep learning-based framework to detect first-time-appeared malware effectively and efficiently by providing better performance than conventional malware detection approaches. First, it translates and visualises each Windows portable executable (PE) file into a coloured image to eliminate the overhead of feature extraction and the need for domain experts to analyse the features. In the subsequent step, a fine-tuned deep learning model is used to extract the deep features from the last fully connected layer. The step has reduced the cost of training required by the deep learning models if used for end-to-end classification. The third step selects the most important and influential features through a powerful feature selection algorithm. The most important features are then fed to a one-class classifier for final detection. With the one-class classifier, an enclosed boundary around the features of benign data is constructed. Anything outside the boundary is declared as an anomaly/malicious. It has enhanced the framework's ability to detect evolving, unseen, polymorphic, and zero-day attacks, as well as reducing the problem of overfitting. The detection effectiveness of the proposed framework is validated with state-of-the-art deep learning models and conventional approaches. The proposed framework has outperformed with an accuracy of 99.30% on the Malimg dataset. The Wilcoxon signed-rank test is used to validate the statistical significance of the proposed framework. It is evident from the results that the proposed framework is effective and can be used in the defence industry, resulting in more powerful and robust solutions against zero-day and polymorphic attacks.

Using deep graph learning to improve dynamic analysis-based malware detection in PE files

Black-Box Adversarial Attacks Against Deep Learning Based Malware Binaries Detection with GAN

Discovering Malicious Signatures in Software from Structural Interactions

Malware Analysis Using Machine Learning and Deep Learning Techniques

MalGraph: Hierarchical Graph Neural Networks for Robust Windows Malware Detection

Guided Malware Sample Analysis based on Graph Neural Networks

Deep Graph Neural Networks for Malware Detection Using Ghidra P-Code

A novel machine learning approach for detecting first-time-appeared malware

A dynamic Windows malware detection and prediction method based on contextual understanding of API call sequence

Feature graph construction with static features for malware detection

Malware Detection by Control-Flow Graph Level Representation Learning With Graph Isomorphism Network

Android Malware Detection using Large-scale Network Representation Learning

Leveraging deep learning and image conversion of executable files for effective malware detection: A static malware analysis approach

A Malware Detection Approach based on Deep Learning and Memory Forensics

MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning

Detecting Cryptomining Malware: a Deep Learning Approach for Static and Dynamic Analysis

An unknown malware detection scheme based on the features of graph

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

A Review of Deep Learning Based Malware Detection Techniques

Graph embedding as a new approach for unknown malware detection

Sequence-based malware detection using a single-bidirectional graph embedding and multi-task learning framework