Source-linked AI summary
Transfer Learning for Image-Based Malware Classification
Niket Bhodia, Pratikkumar Prajapati, Fabio Di Troia, Mark Stamp
TL;DR
The paper examines how image-based deep learning compares with simpler malware classifiers, a comparison missing from prior work. It applies transfer learning to binaries converted into images and compares the results with executable-feature k-NN; k-NN often performs better, while deep learning performs better in simulated zero-day experiments.
Problem
Prior work had not directly compared image-based deep learning with simpler machine-learning techniques, making their comparative advantages unclear.
Source: §1 · p. 1Method
Results
k-NN outperforms image-based deep learning in some cases, while deep learning performs better in simulated zero-day experiments and is reported to generalize better than k-NN.
Source: §4 · pp. 6–7, §5 · p. 8Takeaways & Limitations
The results indicate that image-based deep learning’s stronger generalization in simulated zero-day experiments may be an advantage for malware detection, while k-NN’s simplicity and ease of training may matter in some situations.
Source: §4 · p. 7, §5 · p. 8Because the Malimg binary files were unavailable, the authors could not compare its deep-learning results with alternatives using features extracted from binaries.
Source: §4 · p. 4
Abstract
from arXiv · showhide
In this paper, we consider the problem of malware detection and classification based on image analysis. We convert executable files to images and apply image recognition using deep learning (DL) models. To train these models, we employ transfer learning based on existing DL models that have been pre-trained on massive image datasets. We carry out various experiments with this technique and compare its performance to that of an extremely simple machine learning technique, namely, k-nearest neighbors (\kNN). For our k-NN experiments, we use features extracted directly from executables, rather than image analysis. While our image-based DL technique performs well in the experiments, surprisingly, it is outperformed by k-NN. We show that DL models are better able to generalize the data, in the sense that they outperform k-NN in simulated zero-day experiments.
1 INTRODUCTION
The paper asks how image-based deep learning compares with simpler non-image malware classifiers, a comparison that prior work had not clearly established. It extends earlier image-based analysis and finds that the approaches have different strengths.
- The study compares transfer-learned image-based deep-learning models with k-NN using static executable features.Source: §1 · p. 1
- Prior work lacked a direct comparison between image-based deep learning and simpler machine-learning techniques, leaving their comparative advantages unclear.Source: §1 · p. 1
- The comparison extends earlier work with improved deep-learning training, a more challenging dataset, and experiments intended to reveal the approaches’ strengths and weaknesses.Source: §1 · p. 1
2 METHODOLOGY
The study evaluates image-based deep learning and executable-feature k-NN across two malware datasets, with different preprocessing requirements. Its image conversion represents binary bytes as grayscale pixels, while k-NN uses features extracted directly from binaries.
2.1 Datasets
- The study uses Malimg, with 9,339 images from 25 families, and Malicia, with 11,668 binaries from 54 families.Source: §2.1 · p. 2
- After excluding 581 non-executable files and 1,192 samples without family labels, Malicia contains 9,895 binaries from 51 families; the study also uses two benign sets of 3,304 and 704 binaries.Source: §2.1 · p. 2
2.2 Data Preprocessing
- Malimg needs no image preprocessing, whereas Malicia binaries are converted to images; k-NN instead uses binary features and cannot be tested on Malimg because its binaries are unavailable.Source: §2.2 · p. 2
2.3 Converting Binaries to Images
- Each binary is represented as a grayscale PNG with a fixed width of 256 pixels and a length determined by binary size.Source: §2.3 · p. 3
2.4 Feature Extraction for k-NN
- The k-NN approach extracts 54 features from each binary; Table 3 illustrates 15 features and gives values for a benign sample.Source: §2.4 · p. 3, Table 3 · p. 3
2.5 Implementation Details
- Deep-learning models use fast.ai on PyTorch, while k-NN uses Scikit-learn; fast.ai’s CUDA support accelerates training with a graphics card.Source: §2.5 · p. 3
3 EXPERIMENTS AND RESULTS
The experiments vary dataset, classification level, and learning technique, comparing transfer-learned ResNet models with k-NN. ResNet34 is used for reported deep-learning experiments after more complex variants showed no significant improvement.
- The experiments vary dataset, binary versus multiclass classification, and learning technique across eight combinations.Source: §3 · p. 3, Table 4 · p. 4
- The deep-learning experiments test ResNet34, ResNet50, ResNet101, and ResNext50, which were pre-trained on ImageNet’s 1.2 million images across 1,000 classes.Source: §3 · pp. 3–4
- More complex ResNet variants yielded no significant improvement, so ResNet34 was used for all reported deep-learning experiments.Source: §3 · p. 4
- The deep-learning training tested hyperparameters and techniques including cosine annealing, learning-rate finding, restarts, layer freezing and unfreezing, and differential learning rates.Source: §3 · p. 4
- The k-NN experiments use Euclidean distance and a 54-feature vector extracted from executable files, with k = 1 selected after testing k = 1 through 9.Source: §3 · p. 4
4 DISCUSSION
Across experiments, image-based DL confirmed strong Malimg results, but k-NN achieved higher accuracy on Malicia; in simulated zero-day tests, DL generalized better. The section also notes that Malimg binaries were unavailable for comparison with executable-feature alternatives.
4 DISCUSSION
- Without access to Malimg binaries, the authors could not compare its image-based DL results against alternatives using executable features.They therefore turned to Malicia for that comparison.Source: §4 · pp. 4–5
- Malimg image-based DL reached 98.39% binary and 94.80% multiclass accuracy, comparable to results in.The multiclass experiment included 25 malware families and Windows benign as a 26th class.Source: §4 · p. 4, Figure 3 · p. 5, Figure 4 · p. 5
- On Malicia, image-based DL reached 97.61% binary and 92.93% multiclass accuracy; the multiclass task was harder than Malimg’s despite having fewer classes.Only four large Malicia families were included: the multiclass comparison used five classes versus Malimg’s 26.Source: §4 · p. 5, Figure 6 · p. 6, Figure 7 · p. 6
- In simulated zero-day tests, image-based DL identified 79% of malware with a 1% false positive rate; k-NN performed broadly similarly but somewhat worse.Malware test samples came from small Malicia families, and benign testing used 704 Cygwin binaries.Source: §4 · p. 7, Figure 10 · p. 8
5 CONCLUSION
The conclusion reports high multiclass accuracy across many malware families, but finds that k-NN sometimes outperforms image-based DL. In simulated zero-day tests, DL generalizes better, and robustness is identified as a promising direction for further experiments.
5 CONCLUSION
- The multiclass experiments attained high accuracy across many malware families.The conclusion describes the results as particularly impressive.Source: §5 · p. 8
- Image-based DL was outperformed by the simpler k-NN technique in some cases, but performed better in simulated zero-day experiments.The authors interpret the zero-day result as evidence that this DL implementation generalizes better than k-NN.Source: §5 · p. 8
- Further experiments are proposed to better quantify the potential robustness of image-based malware analysis.The conclusion presents robustness as a promising avenue for future work.Source: §5 · p. 8