Source-linked AI summary
Malware Detection using Machine Learning and Deep Learning
Hemant Rathore, Swati Agarwal, Sanjay K. Sahay, Mohit Sewak
TL;DR
Malware’s expanding scale and complexity challenge signature-based defenses, which cannot detect zero-day attacks and struggle with rapidly generated variants. This study uses opcode-frequency features in machine-learning and deep-learning classifiers, and reports that random forest with variance threshold outperforms the tested deep neural networks on the Malicia dataset.
Problem
Signature-based detection cannot protect against zero-day attacks, and obfuscation-generated variants make human-driven signature creation difficult to scale.
Source: §1 · p. 2Method
The study classifies malware and benign files using static opcode-frequency features, dimensionality-reduction methods, and random-forest and deep-neural-network models.
Source: §2 · p. 3, §2.3 · p. 4, §5 · p. 9Results
Random forest with variance threshold achieved 99.78% accuracy, outperforming the three tested deep neural network models on the Malicia dataset.
Source: §5 · p. 9Takeaways & Limitations
On the Malicia dataset, variance threshold outperformed auto-encoders for feature reduction, and the authors conclude deep learning may be overkill for this dataset.
Source: §5 · p. 9
Abstract
from arXiv · showhide
Research shows that over the last decade, malware has been growing exponentially, causing substantial financial losses to various organizations. Different anti-malware companies have been proposing solutions to defend attacks from these malware. The velocity, volume, and the complexity of malware are posing new challenges to the anti-malware community. Current state-of-the-art research shows that recently, researchers and anti-virus organizations started applying machine learning and deep learning methods for malware analysis and detection. We have used opcode frequency as a feature vector and applied unsupervised learning in addition to supervised learning for malware classification. The focus of this tutorial is to present our work on detecting malware with 1) various machine learning algorithms and 2) deep learning models. Our results show that the Random Forest outperforms Deep Neural Network with opcode frequency as a feature. Also in feature reduction, Deep Auto-Encoders are overkill for the dataset, and elementary function like Variance Threshold perform better than others. In addition to the proposed methodologies, we will also discuss the additional issues and the unique challenges in the domain, open research problems, limitations, and future directions.
1 Introduction
Malware threatens devices, information, networks, and critical infrastructure while imposing substantial financial losses. Signature-based defenses struggle with zero-day attacks, rapidly generated variants, and the scale of manual signature creation, prompting research into machine-learning and deep-learning detection.
1 Introduction
- Malware can compromise devices, steal confidential information, penetrate networks, and cripple critical infrastructure; estimated damage was $3 trillion in 2015 and was projected to reach $6 trillion by 2021.The estimate and projection were attributed to Cybersecurity Ventures in 2016.Source: §1 · pp. 1–2
- Signature-based detection cannot protect against zero-day attacks, while obfuscation toolkits generate variants and human-driven signature creation is becoming infeasible as malware grows.The passage gives Zeus as an example of a toolkit generating thousands of variants.Source: §1 · p. 2
- The surveyed literature spans feature extraction and reduction, followed by classification models built from the resulting feature vectors.Features may come from static or dynamic analysis, and reported approaches use machine learning and deep learning.Source: §1 · pp. 2–3
2 Experimental Setup
The experimental pipeline frames malware detection as binary classification and proceeds through data collection, disassembly, opcode-frequency feature construction, dimensionality handling, model building, and empirical analysis.
2 Experimental Setup
- Malware detection is framed as binary classification, and the proposed workflow runs from dataset collection through feature extraction and dimension reduction to classification and empirical analysis.Figure 1 is identified as a flowchart for classification using different feature sets.Source: §2 · p. 3, Figure 1 · p. 5
2.1 Dataset
- The dataset combines Malicia malware with Windows benign executables, retaining 11,308 malware and 2,819 benign files after corrupted or encrypted executables were removed.The Malicia samples came from 11 months of collection across more than 500 drive-by download servers; benign files were accepted when VirusTotal reported them harmless.Source: §2.1 · pp. 3–4, §2.2 · p. 4
2.2 Disassembling of Malicious and Benign Executables
- The researchers disassembled executable files into assembly code with GNU Binutils’ object dump utility before generating features.Corrupted or encrypted files were excluded at this stage.Source: §2.2 · p. 4
2.3 Creation of Feature Vector space
- Static feature vectors use a master list of 1,600 unique opcodes, with files as rows, opcode frequencies as columns, and each entry counting an opcode’s occurrences.The resulting matrices contain 2,819 × 1,600 benign-file entries and 11,308 × 1,600 malware-file entries.Source: §2.3 · p. 4
2.4 Other issues
- ADASYN oversamples the minority class with synthetic examples based on k-nearest neighbors, and experiments use three-fold cross-validation.Each rotation trains on two folds and tests on the remaining fold; the figure describes a classification flow using different feature sets.Source: §2.4 · pp. 4, 6, Figure 1 · p. 5
3 Modelling Malware Detection
The modeling pipeline reduces the 1,600-opcode feature space before comparing random forests with deep neural networks. It evaluates feature-reduction variants and models of differing depths.
3.1 Dimensionality Reduction
- The 1,600-opcode feature space includes deprecated, zero-frequency, or platform-specific features, motivating reduction to address training time and space complexity.The study compares multiple reduction variants to choose an optimal feature count.Source: §3.1 · p. 6
- The reduction options are no reduction, a variance threshold removing features below 0.1, and unsupervised auto-encoders that use opcode frequencies without class labels.The variance-threshold method treats low-variance attributes as having less predictive power.Source: §3.1 · p. 6
- AE-1L uses an input–32–output architecture, whereas AE-3L uses input–128–64–32–64–128–output; both use ELU bottleneck nodes and mean squared error training.The auto-encoders use a batch size of 64, Adam, and 120 epochs; Figure 2 plots AE-1L training and validation mean squared error across epochs.Source: §3.1 · pp. 6–7
3.2 Building the learning model
- The study compares random forest with DNNs having two, four, or seven hidden layers, using ELU hidden layers, softmax output, Adam, cross-entropy loss, and 0.1 dropout.The DNN hidden-layer widths range from (1024, 32) for DNN-2L to (1024, 512, 256, 128, 64, 32, 16) for DNN-7L; Figure 3 plots DNN-2L training and validation cross-entropy across 120 epochs.Source: §3.2 · pp. 7–8
4 Results
Random Forest performed best among the compared classifiers, while Variance Threshold was the strongest feature-reduction method. Results were assessed using accuracy, recall, selectivity, and precision.
4 Results
- The experiments compared feature-reduction methods and classifiers using accuracy, recall, selectivity, and precision.Source: §4 · p. 8
- VT with RF achieved 99.78% accuracy, marginally above 99.74% with no reduction; AE-1L outperformed AE-3L, which performed lowest across methods.VT with RF had the highest TPR at 99.59%, while no reduction with RF had the highest TNR at 100%.Source: §4 · p. 8
- RF with VT achieved 99.7% accuracy and outperformed the deep learning models; DNN-3L and DNN-7L with AE-1L each reached 98.99%.The comparison also reports RF as the strongest classifier with no feature reduction.Source: §4 · p. 8
5 Conclusion
The authors frame malware detection as a machine-learning and deep-learning problem and compare Random Forest with deep neural networks. Random Forest with Variance Threshold produced the best reported accuracy, while the authors identify possible overfitting on Malicia and propose future tests.
5 Conclusion
- The authors identify signature-based antivirus detection as unable to cope with new-age malware challenges.Source: §5 · p. 8
- The study applies machine learning and deep learning to malware detection, using feature reduction and comparing RF with DNN models.The authors report using cross-validation and addressing class imbalance.Source: §5 · p. 9
- RF outperformed all three DNNs, reaching 99.78% accuracy with Variance Threshold, a 1.26% improvement over the previously reported best accuracy.The authors also report that Variance Threshold outperformed auto-encoders for feature reduction.Source: §5 · p. 9
- For the Malicia dataset, the authors suggest deep learning may be overkill and report that the trained models are moving toward overfitting.Source: §5 · p. 9
- Future work could test these models on polymorphic and metamorphic malware and assess recurrent neural networks and long short-term memory methods.Source: §5 · p. 9