NLP Technique for Malware Detection Using 1D CNN Fusion Model

Abstract

With the record of the highest market share of mobile operating systems, the Android operating system has become a prime target for cyber perpetrators as malicious applications are leveraged as attack vectors to exploit Android systems. Machine learning detection solutions that have become a resort mostly rely on handcrafted features, a process deemed to be laborious and time-consuming. In this article, we employ a deep learning-based model consisting of 1-dimensional convolutional neural network (1D CNN) to automate the detection of Android malware. Our choice of 1D CNN was motivated by the computational advantage of 1D convolution operations over 2D CNN. The proposed model automatically extracts features from semantically embedded n-grams of raw static operation code (opcodes) sequences to determine the maliciousness of a binary file. Predictions of the 1D CNN model trained on multiple feature sets of n-gram opcode sequences are combined using a weighted average ensemble. Optimal prediction weights were obtained using a grid search on values in the range 0 to 1. With an Android dataset comprising 4951 malware and 2477 benign samples, our model yielded a positive predictive value of 98% and sensitivity of 97% using a weight parity of 0.5 for ensemble unigram and bigram opcode sequences.

Rapid diagnosis of celiac disease based on plasma Raman spectroscopy combined with deep learning

“…Convolutional Neural Network (CNN) is a deep feedforward neural network with features such as local connections and weight sharing. As one of the representative algorithms of deep learning, CNN has significant advantages in complex machine learning problems such as image classification, computer vision, natural language processing 24 – 27 , making it one of the most widely used models. The components of CNN include basic input and output layers, as well as convolutional layers, pooling layers, and fully connected layers 28 .…”

Semantic and traditional feature fusion for software defect prediction using hybrid deep learning model

“…Deep learning techniques, especially CNN, have succeeded remarkably across various domains, including visual pattern classification 14 – 16 , natural language processing 17 , 18 , and computer vision 19 – 21 . CNNs excel at learning and extracting complex patterns and features from data, which is particularly beneficial for capturing semantic information from source code.…”

Malware Detection Approaches based on Operational Codes (OpCodes) of Executable Programs: A Review

“…However, detecting malware depends on a precise and accurate malware analysis, which firstly is carried out prior to classifying the underlying illegitimate program, and then is detected and prevented. Particularly, malware analysis is divided into three main kinds of analyses, namely static malware analysis, [3], [5], [6], [7]- [15], dynamic malware analysis [6], [11], [16]- [19], and hybrid malware analysis [11], [20]. The advantages and disadvantages of each kind are described subsequently.…”

“…The advantages and disadvantages of each kind are described subsequently. Besides, each of these three kinds of malware analyses could be conducted automatically or manually (nonautomatically) [7], [10], [12], [21].…”