Improved Deep Learning Model for Static PE Files Malware Detection and Classification

Abstract

Static analysis and detection of malware is a crucial phase for handling security threats. Most researchers stated that the problem with the static analysis is an imbalance in the dataset, causing invalid result metrics. It requires more time for extracting features from the raw binaries, and methods like neural networks require more time for the training. Considering these problems, we proposed a model capable of building a feature set from the dataset and classifying static PE files efficiently. The research work was conducted to emphasize the importance of feature extraction rather than focusing on model building. The well-extracted features help to provide better results when fed to neural networks with minimal numbers of layers. Using minimum layers will enhance the performance of the model and take fewer resources and time for the processing and evaluation. In this research work, EMBER datasets published by Endgame Inc. containing PE file information are used. Feature extraction, data standardization, and data cleaning techniques are performed to handle the imbalance and impurities from the dataset. Later the extracted features were scaled into a standard form to avoid the problems related to range variations. A total of 2381 features are extracted and pre-processed from both the 2017 and 2018 datasets, respectively. The pre-processed data is then given to a deep learning model for training. The deep learning model created using dense and dropout layers to minimize the resource strain on the model and deliver more accurate results in less amount of time. The results obtained during experimentation for EMBER v2017 and v2018 datasets are 97.53% and 94.09%, respectively. The model is trained for ten epochs with a learning rate of 0.01, and it took 4 minutes/epoch, which is one minute lesser than the Decision Tree model. In terms of precision metrics, our model achieved 98.85%, which is 1.85% more as compared to the existing models.

Interpretable Detection of Malicious Behavior in Windows Portable Executables Using Multi-Head 2D Transformers

“…In Table 1, we present a comparison of our model's results against state-of-the-art techniques, such as those proposed by Refs. [15,17,19]. Our model's performance is on par with these previous works.…”

“…Our analysis suggests that these features, such as filaments and holes, correspond with malicious behavior in the code. Our model's ability to detect these features is highly dependent on the value of , DLMD [15] 0.9676 − − − 0.0872 − Li et al [17] 0.9731 − 0.9724 − − − Lad and Adamuthe [18] 0.9409 0.9014 0.8866 0.1571 − 0.9100 Ravi et al [19] 0 We further study this phenomenon and apply grid search to fine-tune this hyperparameter for specific categories of malware. We observe that different families lend themselves to better analysis with different values of .…”

“…However, our work is different in two respects: (1) we work with a collection of a much larger sample size by combining Ember with other newer datasets; and (2) we apply a more comprehensive model that not only makes predictions but also enables interpretability. A similar approach has been followed by Li et al [17] who have augmented intrinsic features of malware to improve detection. However, as noted before, this involves human intervention for analysis, thus making this approach infeasible for large-scale deployment.…”

Android Malware Detection Approach Using Stacked AutoEncoder and Convolutional Neural Networks

“…In addition, the authors have proposed a solution based on the use of binary file representation and self-organizing maps. Another research by (Sumit & Adamuthe, 2022), it is to propose a deep learning model capable of building a feature set from the EMBER dataset and classifying the malicious codes' static PE files efficiently. In earlier work, Atacak et al (2022) proposed a hybrid detection system that combines the feature extraction and dimension reduction power of the convolution layers in the CNN architecture, and the decisionmaking capability of fuzzy logic is proposed.…”