Deep Learning for Classification of Malware System Call Sequences

By Bojan Kolosnjaji, Apostolis Zarras, George D. Webster, Claudia Eckert. Australasian Conference on Artificial Intelligence, 2016

528 citations recorded by the source corpus.

The increase in number and variety of malware samples amplifies the need for improvement in automatic detection and classification of the malware variants. Machine learning is a natural choice to cope with this increase, because it addresses the need of discovering underlying patterns in large-scale datasets. Nowadays, neural network methodology has been grown to the state that can surpass limitations of previous machine learning methods, such as Hidden Markov Models and Support Vector Machines. As a consequence, neural networks can now offer superior classification accuracy in many domains, such as computer vision or natural language processing. This improvement comes from the possibility of constructing neural networks with a higher number of potentially diverse layers and is known as Deep Learning.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c0927ffb79810318daab8821068629975cab67ad

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, background): “Malware detection has greatly advanced beyond traditional defenses [95], [92] due to innovations such as machine learning based detection [108], [65], [54], [53] and threat intelligence computing [101].”
Applying convolutional neural network for network intrusion detection (2017, methodology): “In [21] proposed deep learning based methods for classifying malware based on system call traces.”
Machine Learning and Deep Learning Methods for Cybersecurity (2018, methodology): “This architecture embodies a hierarchical feature extraction method that combines the features of the n-gram [75] instruction with the simple vectorization of convolution.”
A Survey of Deep Learning Methods for Cyber Security (2019, methodology): “[79] 63 Malware Detection Virus Share [68], Maltrieve Private”
Malware Detection by Eating a Whole EXE (2017, methodology): “Kolosnjaji et al. (2016) tackled the related problem of malware family clas-siﬁcation (i.e., which family does a particular malicious ﬁle belong to?) using a combination of convolutions followed by LSTMs to process the sequence of API calls a malware ﬁle generated under dynamic analysis.”
Robust Intelligent Malware Detection Using Deep Learning (2019, methodology): “There exists few research studies towards the application of deep learning architectures for malware analysis to improve cyber security [13], [11], [12], [17], [18], [18]–[24].”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “Recently, deep learning (ANN’s rebranded descendant)-based scheme has also came out, which applies a higher number of diverse hidden layers to extract features from the n-grams [63].”
Evaluation and Design of Robust Neural Network Defenses (2018, background): “, 2016 [63] Malware 4,700 Dynamic Kabanga et al.”
Black-Box Attacks against RNN based Malware Detection Algorithms (2017, background): “Malware detection is regarded as a sequential classification problem [25, 30, 14].”