ConvProtoNet: Deep Prototype Induction towards Better Class Representation for Few-Shot Malware Classification

Tang, Zhijie; Wang, Peng; Wang, Junfeng

doi:10.3390/app10082847

Cited by 26 publications

(15 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With the development of deep learning algorithms, Cui et al [4] proposed a method for malware classification based on malware raw bytes combined with convolutional neural networks. Tang et al [7] proposed a method to solve the lacking data problem and improve the performance of malware few-shot classification based on the deep learning algorithm. Edmar et al [25] utilized VGG16 network to extract features from the raw bytes, and classified the malware based transfer learning algorithms, which improved the classification performance.…”

Section: Malware Detection Based On Texture Featuresmentioning

confidence: 99%

See 1 more Smart Citation

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

Guo

Huang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

With the rapid development of the Internet, malware variants have increased exponentially, which poses a key threat to cyber security. Persistent efforts have been made to classify malware variants, but there are still many challenges, including the incapacity to deal with various malware variants belonging to similar families, the problem of time and resource consuming, etc. This paper proposes a novel method, called Malware Entropy Sequences Reflect the Family (MESRF), to improve the classification of malware based on the entropy sequences features. In prior research, entropy demonstrated good performance in many areas. First, the global features of the signals were extracted from the entropy sequences by some statistical methods. Next, some local features (i.e. structural entropy features) are extracted based on the discrete wavelet decomposition algorithm and vectorized by the Bag-of-words model, endowing it the high accuracy of malware classification. To evaluate our method, we conducted numerous experiments on the malware datasets with more than 20,000 samples. Through experiments, MESRF showed superiority comparing with other malware classification models, and the accuracy and ROC of the method even could reach 99.83% and 99.98% respectively on the malimg dataset.

show abstract

Section: Malware Detection Based On Texture Featuresmentioning

confidence: 99%

“…Recently, rather than focusing on non-textured features for malware classification, several scholars [3]- [7] proposed new methods based on binary texture features of malware. They transformed the raw bytes of malware samples into twodimensional vectors.…”

Section: Introductionmentioning

confidence: 99%

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

Guo

Huang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Besides, with the rapid development of deep learning technology, Cui et al [4], Rezende et al [28], and Tang et al [7] proposed better methods of malware classification based on deep learning algorithms. Cui et al [4] visualized the malware samples and classified the malware based on convolutional neural networks.…”

Section: Malware Detection Based On Visualization Featuresmentioning

confidence: 99%

“…ey also propose a method to improve the classification performance in the case of insufficient training samples. Tang et al [7] also proposed a malware classification method based on deep learning algorithms.…”

Section: Malware Detection Based On Visualization Featuresmentioning

confidence: 99%

“…In recent years, with the rapid development of deep learning algorithms and image recognition technologies, rather than focusing on these nonvisual detection methods, many researchers have proposed new classification methods based on malware visualization methods [3][4][5][6][7]. ey transform the raw bytes of malware into grayscale images and extract the malware texture features for classification.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Binary File’s Visualization and Entropy Features Analysis Combined with Multiple Deep Learning Networks for Malware Classification

Guo

Huang

et al. 2020

Security and Communication Networks

View full text Add to dashboard Cite

In recent years, the research on malware variant classification has attracted much more attention. However, there are still many challenges, including the low accuracy of classification of samples of similar malware families, high time, and resource consumption. This paper proposes a new method of malware classification based on multiple visual features of malware and deep learning algorithms. In prior research, visualization techniques and entropy demonstrated exemplary performance in many areas. This paper extracts numerous visual features from the raw bytes and entropy sequence of the malware, which makes it more sensitive to malware samples of similar families and endows it the ability to classify malware variants more accurately. To evaluate the proposed method, this paper conducted a series of experiments on two malware datasets with a total of more than 20,000 samples provided by the Malware Research Lab and Microsoft Research. Through experiments, the method showed its superiority compared with some leading malware visual classification methods, achieving good performance on the accuracy with at least 1% improvement. The accuracy of the method even could reach 99.73% and 99.54%, respectively, on the two datasets.

show abstract

Network Intrusion Detection System Based on an Adversarial Auto-Encoder with Few Labeled Training Samples

Shiomoto

2022

J Netw Syst Manage

View full text Add to dashboard Cite

Network intrusion detection systems (NIDS) are critical to defending network systems from cyber attacks. Recently, machine learning has been applied to enhance NIDS capability. To train a supervised machine-learning model, a large number of labeled training samples are required to achieve practical performance. However, labeling data samples is a costly task. Additionally, obtaining anomaly data samples is difficult because trends in network traffic that are subject to NIDS change daily, and new attacks continue to be generated. To address this issue, we propose a semi-supervised machine-learning-based NIDS that reduces the required number of labeled training samples by applying an adversarial auto-encoder (AAE) technique. We evaluated the proposed method through a series of experiments and confirmed that the proposed AAE-based NIDS achieves performance comparable to that of multi-layer perceptron-based NIDS with only 0.1% of the labeled training samples. We also confirmed that the selection of data samples for annotation does not affect the performance of the proposed AAE-based NIDS. We also evaluated the relationship between the performance of the proposed method and the dimension of its latent-variable vector. The best performance as measured by recall and F1 score occurred when the dimensionality of the latent variable vector was 10, which suggests that this structure allows for accurate decomposition of attack and normal. This study presents promising results obtained by the proposed semi-supervised learning method with a reduced number of labeled training samples, which reduces the operational costs of a machine-learning-based NIDS.

show abstract

ConvProtoNet: Deep Prototype Induction towards Better Class Representation for Few-Shot Malware Classification

Cited by 26 publications

References 37 publications

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

Binary File’s Visualization and Entropy Features Analysis Combined with Multiple Deep Learning Networks for Malware Classification

Network Intrusion Detection System Based on an Adversarial Auto-Encoder with Few Labeled Training Samples

Contact Info

Product

Resources

About