Source-linked AI summary
Malware Detection by Eating a Whole EXE
Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, Charles Nicholas
TL;DR
Malware detection from raw executable bytes addresses the limits of signature-based and domain-engineered approaches, but requires learning from sequences exceeding two million steps and sparse file-level supervision. The paper introduces MalConv, a convolutional neural network for entire binaries with global pooling and sparse activation maps, and reports consistent generalization across test sets while identifying batch normalization as a failure mode.
Problem
Signature-based and domain-engineered malware detection has limited ability to generalize to new or adversarially modified binaries, motivating raw-byte learning from entire executables.
Method
MalConv uses a convolutional architecture with global max-pooling on raw bytes to process entire long binaries and identify interpretable important regions.
Results
MalConv achieves consistent generalization across both test sets, with performance that is best or second best on both reported metrics and test sets.
Takeaways & Limitations
Neural networks can be applied to raw entire-executable bytes while addressing extremely long sequences and reducing reliance on specialized domain-knowledge feature processing.
Takeaways & Limitations
The model may miss correlations across large binary ranges, while spatial discontinuities at the function level remain difficult.
Abstract
from arXiv · showhide
In this work we introduce malware detection from raw byte sequences as a fruitful research area to the larger machine learning community. Building a neural network for such a problem presents a number of interesting challenges that have not occurred in tasks such as image processing or NLP. In particular, we note that detection from raw bytes presents a sequence problem with over two million time steps and a problem where batch normalization appear to hinder the learning process. We present our initial work in building a solution to tackle this problem, which has linear complexity dependence on the sequence length, and allows for interpretable sub-regions of the binary to be identified. In doing so we will discuss the many challenges in building a neural network to process data at this scale, and the methods we used to work around them.
1 Introduction
Malware detection matters because signature-based antivirus struggles with novel and adversarially modified binaries. The paper frames raw-byte neural detection as a challenging machine-learning problem involving multimodal bytes, irregular spatial structure, and sequences exceeding two million steps.
- Motivation: Signature-based antivirus rules are usually too specific to recognize new malware, motivating techniques that generalize across previously unseen binaries.The authors note that millions of new malware samples appear daily and that malware is often intentionally adjusted to evade detection.
- Motivation: Dynamic analysis requires instrumented environments, imposes high computational costs, and can be evaded when malware detects analysis.The analysis environment may also differ from the malware’s target environment.
- Approach: The paper instead uses static analysis of raw file bytes with a neural network to determine maliciousness without executing the binary.The approach seeks to learn higher-level representations directly from raw inputs.
- Challenges: PE malware bytes have multiple modalities and context-sensitive meanings, including text, binary code, and embedded objects such as images.These modalities complicate treating each byte as an isolated sequence element.
- Challenges: Binary contents exhibit discontinuous spatial correlations and can be rearranged while preserving program meaning.Function ordering and jumps create spatial structures unlike ordinary image-like locality.
- Challenges: Over two million time steps make whole-file malware detection an unusually long sequence-classification problem.The paper presents a network architecture that can process such raw byte sequences and reports a batch-normalization failure during development.
2 Related work
Prior malware-detection systems commonly rely on domain knowledge, dynamic analysis, or compressed feature representations, while prior long-sequence neural methods operate at substantially smaller scales. This work targets entire raw binaries while reducing specialized feature processing and confronting sparse information flow from a single file-level label.
- Long-sequence models: Earlier sequence models generally process thousands of steps or fewer, whereas this malware task operates at a scale orders of magnitude beyond prior raw-byte sequence work.WaveNet uses 16,000 time steps per second and a 4,800-step receptive field, still about two orders of magnitude shorter.
- Learning challenge: A file-level benign/malicious label provides only one error signal for decisions across roughly two million time steps.This differs from autoregressive and translation models, which receive frequent label information at each step.
- Malware detection: The paper processes raw bytes from entire executables rather than restricting inputs to short PE-header segments.Earlier fully connected and recurrent models learned malware identification from only 300 PE-header bytes.
- Malware detection: Fixed-length summaries such as entropy, string-length, import, and metadata histograms discard most information about binary content.They retain limited whole-file information while replacing the original content with a fixed-length feature vector.
- Malware detection: Malware-detection research has often used manually engineered or dynamically collected features, requiring substantial domain expertise and sometimes non-public emulation environments.These dependencies increase implementation effort and reduce reproducibility.
3 Training data
The experiments use Group B for training and both Group A and Group B for testing to examine generalization across data sources. A larger corpus is also used to test whether MalConv continues benefiting from more data while byte n-grams plateau.
- Datasets: 400,000 Group B training files are split evenly between benign and malicious classes, with 77,349 files in its test set.The Group B test set contains 40,000 malicious files and the remainder benign.
- Datasets: The Group A test set contains 43,967 malicious and 21,854 benign files.
- Evaluation protocol: Training on Group A severely overfits, whereas training on Group B generalizes to Group A, so experiments train on Group B and test on both groups.Using different-source test sets is intended to quantify generalization while reducing shared biases.
- Evaluation protocol: Group A is treated as the more informative generalization test because it was collected differently and shares fewer biases with Group B.The authors also seek similar performance across both test sets as evidence that learned features are broadly useful.
- Larger corpus: 2,011,786 binaries form a larger corpus containing 1,000,020 benign and 1,011,766 malicious files.The authors use it to examine whether MalConv improves with more training data while byte n-grams appear to plateau.
4 Model Architecture
MalConv is designed to process entire long binaries while tolerating positional variation, balancing local and global context with interpretability. The architecture uses convolution, global max-pooling, learned byte embeddings, and large filters and strides, while experiments expose overfitting and batch-normalization difficulties.
- Model goals: MalConv targets sequence-length scalability, local and global context, and explanatory analysis of flagged malware.These three design goals guide the architecture presented in Figure 1.
- Positional variation: Executable contents can be macro-reorganized without changing meaning, so the architecture is designed around substantial positional variation.The PE-Header points to other contents, and function definitions can also be reordered with corrected addresses.
- Core architecture: Convolution followed by global max-pooling makes detected features useful regardless of their location in the binary.Bytes are mapped through a learned embedding rather than processed as scaled values from 0 to 255.
- Memory constraints: A 500-byte convolutional filter with stride 500 supports a shallow, data-parallel design under severe memory constraints.The first convolution’s activations can cause out-of-memory errors during back-propagation, making deep architectures costly.
- Training: Overfitting recurs across tested architectures because roughly two million input steps must support one benign/malicious loss.DeCov regularization was the most helpful development technique and penalizes correlations among penultimate-layer activations.
- Architecture comparisons: MalConv performed best among many tested alternatives, while deeper convolutional designs reduced performance.The alternatives included up to 13 convolutional layers, recurrent networks, and attention models.
- Pooling: Temporal max-pooling was chosen because it improved performance over average-pooling and better handles sparse informative features.Max-pooling also supports interpretability when only a small fraction of a file is malicious.
5 Results
MalConv performs strongly across malware-classification tests, generalizes across distributions, and supports sparse-CAM inspection of informative binary regions. The results also expose distinct effects of DeCov regularization and batch normalization in this extreme-length, multimodal setting.
- 5.1 Malware classification: MalConv is best or second best on both balanced accuracy and AUC across Group A and Group B test sets.Its smaller performance gap between groups indicates features that generalize across the two distributions.
- 5.1 Malware classification: 4.8 points: DeCov regularization increases accuracy by up to 4.8 points across Group A and Group B test sets.The authors attribute the primary effect to improved decision-threshold calibration rather than a changed underlying concept.
- 5.1 Malware classification: 5.9 and 1.3 points: training on a larger corpus raises Group A and B accuracy by 5.9 and 1.3 points, while Group B AUC increases by 2.4 points.The replicated byte n-gram model instead loses 4.4 Group A accuracy points and 5.0 Group A AUC points.
- 5.2 Manual Analysis: 58-61%: only 58-61% of MalConv’s sparse-CAM information comes from the PE-Header, alongside activations in resource, code, and data sections.This contrasts with prior byte n-gram models, which obtained almost all information from the PE-Header.
- 5.2 Manual Analysis: UPX1 activations support both benign and malicious predictions, suggesting the network did not simply equate packing with maliciousness.Packing is prevalent among malware but also occurs in benign applications, so packing alone is not a reliable indicator.
- 5.3 The Failure of Batch-Normalization: Batch normalization consistently fails to learn or generalize for full binary inputs, with at best 60% training and 50% test accuracy.Random 500-10,000-byte chunks produce smoother activation patterns and allow higher training accuracy, but still only 50% test accuracy.
6 Conclusion
The work demonstrates neural-network malware detection from entire executable byte sequences while addressing unusually long sequences and domain-specific learning challenges. It reports consistent generalization, identifies batch normalization as a potential pitfall, and outlines memory and architectural challenges for future work.
- Neural networks can classify raw bytes from entire executable files and generalize consistently across both test sets despite unprecedented sequence length.
- The work identifies unique learning challenges in extremely long sequences and suggests checking whether batch normalization is appropriate for multimodal binary data.
- Future work must address architectures for multimodal binary information, normalization and initialization schemes, and the memory-intensive nature of processing entire files.
7 Discussion of Alternative Architectures
The authors compare alternatives for handling memory constraints and long executable sequences, finding that chunked or region-based approaches underperform whole-file processing. Local regions often provide noisy supervision or suffer convolutional edge effects, while chunk-combination variants do not match MalConv.
- 7.1 Architectural Approaches: Training on smaller binary regions produced noisy labels, strong overfitting, weak generalization, and unstable convergence compared with MalConv.Test accuracies reached the 80% range with strong regularization, but only about one in ten models converged to a usable solution.
- 7.1 Architectural Approaches: Averaging predictions from multiple random regions did not improve accuracy, supporting the need to process the entire binary scope.
- 7.1 Architectural Approaches: The chunk strategy split the embedding into adjacent portions processed by shared convolution filters, using chunking to pursue model parallelism.The accompanying figure uses dashed lines for split outputs and gray same-name boxes for shared weights.
- 7.1 Architectural Approaches: Chunking before convolutions created multiplied border artifacts because convolution receptive fields spanned substantial portions of each chunk.The tested receptive fields were 500 to 1000 time steps, making edge effects consequential near chunk boundaries.
- 7.1 Architectural Approaches: Moving chunking after convolutions did not meaningfully improve throughput and restricted the implementation to data parallelism.
- 7.1 Architectural Approaches: All tested chunk-combination variants, including LSTMs, GRUs, averaging, hidden states, and attention, underperformed MalConv.
Malware “Images”
Treating binaries as malware images imposes false spatial assumptions and introduces avoidable architectural and computational problems. These issues include image-width choices, discontinuous receptive fields, and resource-intensive alternatives to the final architecture.
- Malware “Images”: Malware images treat each byte as a grayscale pixel and require an arbitrary image width, adding a hyper-parameter and complicating incomplete final rows.The resulting image height varies with binary length, while padding or truncation strategies are required to handle the final row.
- Malware “Images”: Truncating binaries to 256 KB cannot process all executable bytes and can be circumvented by malware placed beyond the retained portion.This strategy only partially resolves the variable image-height problem and excludes binaries larger than the truncation limit.
- Malware “Images”: 2D convolutions over malware images impose gaps in the corresponding raw-byte receptive field, equivalent to a dilated 1D convolution determined by image width.The authors characterize these fixed long-range correlations as false priors because binary bytes do not exhibit meaningful image-like spatial consistency.
- Architecture alternatives: GPU memory limits made architectures without rapid spatial compression impractical, forcing small effective batches and training times lasting weeks to months without obvious convergence.The activation footprint of early convolution layers was a central constraint on exploring deeper or less aggressively compressed designs.
- Architecture alternatives: Deeper networks, recurrent layers, extra filters, larger embeddings, and dilated convolutions generally failed to outperform MalConv or increased overfitting.Quasi-recurrent networks converged but produced worse validation loss, while several regularization variants also ended with worse validation loss.