Deep Neural Network Based Malware Detection Using Two Dimensional Binary Program Features

Abstract

Malware remains a serious problem for corporations, government agencies, and individuals, as attackers continue to use it as a tool to effect frequent and costly network intrusions. Machine learning holds the promise of automating the work required to detect newly discovered malware families, and could potentially learn generalizations about malware and benign software that support the detection of entirely new, unknown malware families. Unfortunately, few proposed machine learning based malware detection methods have achieved the low false positive rates required to deliver deployable detectors. In this paper we a deep neural network malware classifier that achieves a usable detection rate at an extremely low false positive rate and scales to real world training example volumes on commodity hardware. Specifically, we show that our system achieves a 95% detection rate at 0.1% false positive rate (FPR), based on more than 400,000 software binaries sourced directly from our customers and internal malware databases. We achieve these results by directly learning on all binaries, without any filtering, unpacking, or manually separating binary files into categories. Further, we confirm our false positive rates directly on a live stream of files coming in from Invincea's deployed endpoint solution, provide an estimate of how many new binary files we expected to see a day on an enterprise network, and describe how that relates to the false positive rate and translates into an intuitive threat score. Our results demonstrate that it is now feasible to quickly train and deploy a low resource, highly accurate machine learning classification model, with false positive rates that approach traditional labor intensive signature based methods, while also detecting previously unseen malware.

References in corpus (1)

• Adam: A Method for Stochastic Optimization

Cited by in corpus (22)

• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Microsoft Malware Classification Challenge
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning
• EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models
• Imbalanced Malware Images Classification: a CNN based Approach
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Hardware Trojan Attacks on Neural Networks
• Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
• Non-Negative Networks Against Adversarial Attacks
• Generic Black-Box End-to-End Attack Against State of the Art API Call Based Malware Classifiers
• Tools and Techniques for Malware Detection and Analysis
• Adversary Resistant Deep Neural Networks with an Application to Malware Detection
• How Wrong Am I? - Studying Adversarial Examples and their Impact on Uncertainty in Gaussian Process Machine Learning Models
• Towards Principled Uncertainty Estimation for Deep Neural Networks
• HeNet: A Deep Learning Approach on Intel${}^{\circledR }$ Processor Trace for Effective Exploit Detection
• Deep Learning Application in Security and Privacy -- Theory and Practice: A Position Paper
• Time Is of the Essence: Analyzing the Effect of Vertex-Joining Time on Complex Network Evolution
• A Deep Learning Approach to Fast, Format-Agnostic Detection of Malicious Web Content
• Improving Zero-Day Malware Testing Methodology Using Statistically Significant Time-Lagged Test Samples
• Segmented Federated Learning for Adaptive Intrusion Detection System
• Power-Based Attacks on Spatial DNN Accelerators