Source-linked AI summary
Deep learning at the shallow end: Malware classification for non-domain experts
Quan Le, Oisín Boydell, Brian Mac Namee, Mark Scanlon
TL;DR
Digital forensic workloads are growing while trained personnel remain limited, and malware classification traditionally requires specialist knowledge and time-consuming feature extraction. This paper uses deep learning on fixed-size one-dimensional binary representations to classify malware without expert feature engineering, achieving strong validation performance and fast CPU prediction.
Problem
Growing digital forensic workloads and limited trained personnel motivate malware classification methods that avoid specialist knowledge and time-consuming signature extraction.
Method
The approach scales raw binary byte code to a fixed-size one-dimensional representation and evaluates CNN, CNN-UniLSTM, and CNN-BiLSTM models with default or class-rebalanced sampling.
Results
Class-rebalanced CNN-LSTM models improve accuracy and F1 score, with CNN-BiLSTM achieving the best performance; the final model reaches 98:80% validation accuracy and 0:02-second CPU classification.
Takeaways & Limitations
The approach supports malware classification without reverse-engineering or binary-disassembly expertise and enables rapid prediction on new binary files using a CPU.
Takeaways & Limitations
The one-dimensional raw-binary representation does not consider the semantics of the binary code.
Abstract
from arXiv · showhide
Current malware detection and classification approaches generally rely on time consuming and knowledge intensive processes to extract patterns (signatures) and behaviors from malware, which are then used for identification. Moreover, these signatures are often limited to local, contiguous sequences within the data whilst ignoring their context in relation to each other and throughout the malware file as a whole. We present a Deep Learning based malware classification approach that requires no expert domain knowledge and is based on a purely data driven approach for complex pattern and feature identification.
1. Introduction
Digital forensic backlogs and the scarcity of trained personnel create pressure for automated malware analysis. The paper introduces a deep-learning approach intended to classify raw malware binaries without specialist reverse-engineering expertise or complex feature engineering.
- 1. Introduction: Growing digital forensic backlogs reflect increasing case and data volumes alongside limited supplies of trained personnel.These constraints affect both digitally executed and traditional crimes requiring digital evidence processing.
- 1. Introduction: Malware analysis is labor intensive because sandbox-based investigation requires time-consuming manual examination of attack vectors, payloads, communications, and behavior.The required technical background also creates a high barrier for investigators expanding into malware analysis.
- 1. Introduction: The research community identifies automation and intelligent evidence processing as ways to increase digital forensic capacity.AI-based processing is presented as having potential to expedite investigations and reduce case backlog.
- 1.1. Contribution of this work: The work contributes an approach for malware analysis by non-experts without requiring reverse engineering, binary disassembly, assembly-language, or behavioral-analysis expertise.Its stated contribution is malware classification using a deep-learning model rather than specialist user knowledge.
- 1.1. Contribution of this work: The model classifies raw binaries into nine malware classes and processes one binary in 0.02 s on a regular desktop workstation.The contribution passage reports 98:2% accuracy alongside the processing time.
- 1.1. Contribution of this work: The one-dimensional byte representation preserves sequential order, enabling CNN-BiLSTM modeling of relationships among local patterns across the malware sample.This representation is described as simpler than a two-dimensional image representation while supporting the CNN-BiLSTM architecture.
2. Literature review/state of the art
Prior malware-classification methods commonly depend on static or dynamic features extracted with specialist tools and domain knowledge. The reviewed approach instead uses raw static bytecode, normalized at the whole-file level, while preserving sequence context for deep-learning classification.
- 2. Literature review/state of the art: Machine learning reduces manual malware-analysis effort by learning distinctions between labeled malicious, benign, or malware-family examples.For new samples, the trained model infers the relevant class with a certain degree of accuracy.
- 2. Literature review/state of the art: Malware-analysis features include static bytecode properties and dynamic behaviors observed after execution in sandbox environments.Static examples include instructions, strings, imports, and API calls; dynamic features capture operating-system and network interactions.
- 2. Literature review/state of the art: Both static and dynamic feature extraction require specialist tools and domain expertise, while dynamic extraction is generally more time- and resource-intensive.The paper’s approach uses only raw static bytecode without additional feature extraction or feature engineering.
- 2. Literature review/state of the art: Existing deep-learning malware methods commonly train on features produced by parsing, disassembling, or executing binaries rather than on completely raw input.Examples include API-call identifiers, disassembled instructions, imports, strings, and executable metadata.
- 2.3.1. Features from static code: The paper’s differentiator is context-independent normalization of the entire raw executable, avoiding domain-specific analysis while satisfying fixed-length neural-network input requirements.The method does not require information about the meaning or interpretation of the raw data.
- 2. Literature review/state of the art: Compared with two-dimensional bytecode images, the approach preserves the original one-dimensional byte order, retains more detail through a 10,000-byte target, and adds LSTM layers to capture relationships across the sample.Using the same evaluation setup as prior work, the authors report a significant increase in classification accuracy.
3. Methodology
The methodology preprocesses raw malware binaries into fixed-length sequential byte representations, then compares CNN and CNN–LSTM architectures under cross-validation and sampling strategies. The approach targets data-driven classification without specialist feature engineering while preserving sequential structure.
- Dataset: The dataset contains labeled raw hexadecimal malware files and metadata, but the experiments use only raw binary content.The raw representation excludes the PE header, while metadata includes function calls and embedded strings extracted by disassembly.
- Motivation: Deep learning is used to classify malware from raw data without manual, domain-specific feature engineering.This avoids specialist signature extraction and supports automated pattern identification.
- Data pre-processing: Each malware file is scaled to 10,000 bytes as a one-dimensional sequence to standardize inputs while preserving byte order and spatial patterns.Scaling is lossy, but the method avoids choosing a two-dimensional image height and width.
- Data pre-processing: The two-dimensional greyscale rendering is used only for visualization; the classification input remains a sequential byte representation.Each byte becomes a pixel for visualization, and the wrapped image exposes local and file-level patterns.
- Deep learning architectures: CNN layers capture shift-invariant one-dimensional spatial patterns, while recurrent layers summarize dependencies across the whole binary before classification.The models classify inputs into nine malware classes using CNN, CNN–LSTM, or CNN–biLSTM architectures.
- Experiment protocol: The experiment evaluates six configurations combining three architectures with default or class-rebalanced batch sampling, using five-fold cross-validation on the main dataset.The configurations use CNN, CNN-UniLSTM, or CNN-BiLSTM architectures; regularization and hyperparameters are selected through the evaluation procedure.
4. Results and discussion
The CNN-BiLSTM with class-rebalanced sampling performed best among the evaluated configurations, achieving strong validation and test log-loss results. The one-dimensional raw-binary representation supported accurate classification while preserving sequence order, with CPU prediction suitable for rapid processing.
- Configuration comparison: The CNN-BiLSTM with class-rebalanced sampling achieved the best validation F1-score and accuracy among the six configurations.The six configurations combined CNN, CNN-UniLSTM, or CNN-BiLSTM architectures with default or class-rebalanced sampling.
- Final-model performance: The final CNN-BiLSTM model achieved a validation average log-loss of 0.0762 and validation accuracy of 98:80%.Its Kaggle log-loss scores were 0.0655 on the public set and 0.0774 on the private set.
- Final-model performance: The final model’s Kaggle public and private log-loss scores aligned with validation performance, supporting the authors’ claim that it generalizes well to new data.The public score used 30% of the test set, while the private score used 70%.
- Representation: The one-dimensional raw-binary representation simplified malware input, preserved sequential code order, and avoided choosing an image width-to-height ratio.The authors describe it as similar to image-based malware representations while retaining these advantages.
- Sampling and architecture: Class-rebalanced sampling improved both accuracy and F1-score for the CNN-LSTM models by including samples from all classes in each batch.The authors attribute the improvement to a better back-propagation signal for parameter tuning.
- Sampling and architecture: Adding the backward LSTM direction improved performance over CNN-UniLSTM, while the larger performance gain occurred when moving from CNN to CNN-LSTM.CNN training was reported as 10 times faster than CNN-BiLSTM, whereas CNN-BiLSTM used 268,000 parameters versus 1.84 million for CNN.
5. Concluding remarks
The deep learning approach achieves high malware-classification accuracy without feature engineering and classifies binaries quickly. Class rebalancing addresses dataset imbalance, while the one-dimensional raw-binary representation does not capture code semantics.
- 98:2% cross-validation accuracy and 98:8% validation accuracy demonstrate high performance for the deep learning approach.The model classifies malware from raw binary files without feature engineering.
- 0.02 s per binary in experiments indicates short classification time for practical use.
- Class rebalance batch sampling can address the dataset’s class imbalance problem.
- Starting from an available model and updating it with new training data keeps retraining costs small.
- The one-dimensional raw-binary representation does not consider the semantics of binary code.Spatial patterns nevertheless allow deep learning models to predict malware classes effectively.
- Applying deep learning to disassembled files suggests that preserving byte-level semantic meaning can also benefit malware classification.
Future work
Future work will test the approach on larger datasets with more malware classes and explore representations that preserve byte semantics without losing information during compression.
- Future evaluation will use bigger datasets containing more malware classes.
- Preserving each byte’s semantic meaning during preprocessing would require compressing approximately 60 Mbytes without losing that meaning.