MalCaps: A Capsule Network Based Model for the Malware Classification

Abstract

The research on malware detection enabled by deep learning has become a hot issue in the field of network security. The existing malware detection methods based on deep learning suffer from some issues, such as weak ability of deep feature extraction, relatively complex model, and insufficient ability of model generalization. Traditional deep learning architectures, such as convolutional neural networks (CNNs) variants, do not consider the spatial hierarchies between features, and lose some information on the precise position of a feature within the feature region, which is crucial for a malware file which has specific sections. In this paper, we draw on the idea of image classification in the field of computer vision and propose a novel malware detection method based on capsule network architecture with hyper-parameter optimized convolutional layers (MalCaps), which overcomes CNNs limitations by removing the need for a pooling layer and introduces capsule layers. Firstly, the malware is transformed into a grayscale image. Then, the dynamic routing-based capsule network is used to detect and classify the image. Without advanced feature extraction and with only a small number of labeled samples, the presented method is tested on an unbalanced Microsoft Malware Classification Challenge (MMCC) dataset and experimental results produce testing accuracy of 99.34%, improving on a number of traditional deep learning models posited in recent malware classification literature.

A two‐stage deep learning framework for image‐based android malware detection and variant classification

“…Some approaches have leveraged other DL techniques to improve the classification performance of Android malware detection systems. Zhang et al 30 proposed a capsule network architecture for Android malware detection that overcomes the limitation of CNNs of requiring pooling layers by removing them and introducing capsule layers. Chimera, presented in, 31 uses multimodal DL composed of a DNN, CNN, and TN to learn features from DEX grayscale images, static data such as Android intents & permissions, and dynamic data such as sequences of system calls, respectively.…”

A Proposed Artificial Intelligence Model for Android-Malware Detection

“…There have been studies that have used different DL methods to improve Android malware detection systems' effectiveness. Capsule layers were utilized in place of pooling layers in CNNs, as demonstrated by Zhang et al [38]'s proposed network architecture. Chimera Schranko de Oliveira and Sassi [39] employed multimodal DL, which included a DNN, TN and CNN to learn features from images transformed from the DEX files, static data like permissions, Android intents and dynamic data like sequences of system calls [40].…”

Explainable Artificial Intelligence-Based IoT Device Malware Detection Mechanism Using Image Visualization and Fine-Tuned CNN-Based Transfer Learning Model

“…Color images of Android application were used to train a ResNET for malware detection. In the layout used by Zhang et al [19], capsule layers replace pooling layers in CNNs. In Chimera et al [20], dense, convolutional, and textural neural networks were used to learn Android image patterns, for example, patterns of static permissions and authorizations and patterns of dynamic system calls.…”