Learning the PE Header, Malware Detection with Minimal Domain Knowledge

Abstract

Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge, namely byte n-grams and strings. In this work we explore the feasibility of applying neural networks to malware detection and feature learning. We do this by restricting ourselves to a minimal amount of domain knowledge in order to extract a portion of the Portable Executable (PE) header. By doing this we show that neural networks can learn from raw bytes without explicit feature construction, and perform even better than a domain knowledge approach that parses the PE header into explicit features.

References in corpus (11)

• Adam: A Method for Stochastic Optimization
• Efficient Estimation of Word Representations in Vector Space
• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Deep Residual Learning for Image Recognition
• On the difficulty of training Recurrent Neural Networks
• How transferable are features in deep neural networks?
• Character-level Convolutional Networks for Text Classification
• Proceedings of the 29th International Conference on Machine Learning (ICML-12)
• A Theoretically Grounded Application of Dropout in Recurrent Neural Networks
• Density Estimation in Infinite Dimensional Exponential Families

Cited by in corpus (10)

• A Survey of Machine Learning Methods and Challenges for Windows Malware Classification
• A Comprehensive Study on Learning-Based PE Malware Family Classification Methods
• Assessment of the Relative Importance of different hyper-parameters of LSTM for an IDS
• Automatic Malware Description via Attribute Tagging and Similarity Embedding
• Learning from Context: Exploiting and Interpreting File Path Information for Better Malware Detection
• Black-box Attacks Against Neural Binary Function Detection
• Neurlux: Dynamic Malware Analysis Without Feature Engineering
• AMSI-Based Detection of Malicious PowerShell Code Using Contextual Embeddings
• LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach
• Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing