Malware Detection by Eating a Whole EXE

By Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, Charles K. Nicholas. 2017

690 citations recorded by the source corpus.

In this work we introduce malware detection from raw byte sequences as a fruitful research area to the larger machine learning community. Building a neural network for such a problem presents a number of interesting challenges that have not occurred in tasks such as image processing or NLP. In particular, we note that detection from raw bytes presents a sequence problem with over two million time steps and a problem where batch normalization appear to hinder the learning process. We present our initial work in building a solution to tackle this problem, which has linear complexity dependence on the sequence length, and allows for interpretable sub-regions of the binary to be identified. In doing so we will discuss the many challenges in building a neural network to process data at this scale, and the methods we used to work around them.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, background): “These assessments have been recently expanded to systems for Android malware detection [21, 22, 23, 47, 18] and to binary executables (with the adoption of deep learning) [48, 49].”
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research (2022, methodology): “The gradients and weights of different layers of the MalConv architecture [155] and emberMalConv [156] are analyzed to identify different parts’ contributions to the classification.”
Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, methodology): “The first targeted networks trained on binary value features extracted from the files, while the second group focused on CNNs operating directly on the raw executable binary files, like Malconv [39].”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, background): “Many works on problem-space attacks have been explored on different domains: text [3, 43], PDFs [22, 41, 45, 46, 74], Windows binaries [38, 59, 60], Android apps [23, 31, 75], NIDS [6, 7, 20, 28], ICS [76], and Javascript source code [58].”
EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models (2018, methodology): “Nevertheless, we demonstrate that the out-of-the-box LightGBM model trained on these features outperforms recently published work in end-to-end deep learning for malware detection [22].”
A Survey of Android Malware Detection with Deep Neural Models (2020, methodology): “The third setup was adapted from Reference [90] with the introduction of an embedding layer to learn the representations of the input data as tokenized bytes; in particular, a one-dimensional convolution layer was chosen, since the input was raw vectors; then the gating layer was connected to…”
Robust Intelligent Malware Detection Using Deep Learning (2019, methodology): “We introduce several variants of the existing deep learning architectures from [11] and [12].”
Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables (2018, methodology): “2Note that these results are different from [18], as we use different data and experimental settings.”
A Survey on Machine Learning Techniques for Cyber Security in the Last Decade (2020, unknown): “Machine learning techniques were not primarily designed to work with cyber security so an evasion can easily fool the ML [597]–[599].”