DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification

Abstract

This paper presents a novel deep learning based method for automatic malware signature generation and classification. The method uses a deep belief network (DBN), implemented with a deep stack of denoising autoencoders, generating an invariant compact representation of the malware behavior. While conventional signature and token based methods for malware detection do not detect a majority of new variants for existing malware, the results presented in this paper show that signatures generated by the DBN allow for an accurate classification of new malware variants. Using a dataset containing hundreds of variants for several major malware families, our method achieves 98.6% classification accuracy using the signatures generated by the DBN. The presented method is completely agnostic to the type of malware behavior that is logged (e.g., API calls and their parameters, registry entries, websites and ports accessed, etc.), and can use any raw input from a sandbox to successfully train the deep neural network which is used to generate malware signatures.

References in corpus (2)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Improving neural networks by preventing co-adaptation of feature detectors

Cited by in corpus (28)

• Deep Learning for Anomaly Detection: A Survey
• Deep learning at the shallow end: Malware classification for non-domain experts
• Functionality-preserving Black-box Optimization of Adversarial Windows Malware
• A Roadmap Towards Resilient Internet of Things for Cyber-Physical Systems
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
• Malware Detection using Machine Learning and Deep Learning
• Comparison of Deep Learning and the Classical Machine Learning Algorithm for the Malware Detection
• An investigation of a deep learning based malware detection system
• Context2Name: A Deep Learning-Based Approach to Infer Natural Variable Names from Usage Contexts
• DeepAPT: Nation-State APT Attribution Using End-to-End Deep Neural Networks
• Machine Learning (In) Security: A Stream of Problems
• Automatic Yara Rule Generation Using Biclustering
• DAEMON: Dataset-Agnostic Explainable Malware Classification Using Multi-Stage Feature Mining
• End-to-End Deep Neural Networks and Transfer Learning for Automatic Analysis of Nation-State Malware
• Explaining Vulnerabilities of Deep Learning to Adversarial Malware Binaries
• Malware Classification using Deep Learning based Feature Extraction and Wrapper based Feature Selection Technique
• DeepOrigin: End-to-End Deep Learning for Detection of New Malware Families
• Dynamic Malware Analysis with Feature Engineering and Feature Learning
• Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection
• Assessment of the Relative Importance of different hyper-parameters of LSTM for an IDS
• Detecting malicious PDF using CNN
• Learning Malware Representation based on Execution Sequences
• FENXI: Deep-learning Traffic Analytics at the Edge
• LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach
• Artificial Neural Network for Cybersecurity: A Comprehensive Review
• The Curious Case of Machine Learning In Malware Detection
• Using Deep Learning to Solve Computer Security Challenges: A Survey
• A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries