Deep Transfer Learning for Static Malware Classification

Abstract

We propose to apply deep transfer learning from computer vision to static malware classification. In the transfer learning scheme, we borrow knowledge from natural images or objects and apply to the target domain of static malware detection. As a result, training time of deep neural networks is accelerated while high classification performance is still maintained. We demonstrate the effectiveness of our approach on three experiments and show that our proposed method outperforms other classical machine learning methods measured in accuracy, false positive rate, true positive rate and $F_1$ score (in binary classification). We instrument an interpretation component to the algorithm and provide interpretable explanations to enhance security practitioners' trust to the model. We further discuss a convex combination scheme of transfer learning and training from scratch for enhanced malware detection, and provide insights of the algorithmic interpretation of vision-based malware classification techniques.

References in corpus (7)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Densely Connected Convolutional Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Microsoft Malware Classification Challenge
• Imbalanced Malware Images Classification: a CNN based Approach
• Lightweight Classification of IoT Malware based on Image Recognition
• HeNet: A Deep Learning Approach on Intel${}^{\circledR }$ Processor Trace for Effective Exploit Detection

Cited by in corpus (9)

• A Few-Shot Meta-Learning based Siamese Neural Network using Entropy Features for Ransomware Classification
• Machine Learning (In) Security: A Stream of Problems
• Towards resilient machine learning for ransomware detection
• Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning
• Towards Interpretable Ensemble Learning for Image-based Malware Detection
• Understanding the efficacy, reliability and resiliency of computer vision techniques for malware detection and future research directions
• Transferable Cost-Aware Security Policy Implementation for Malware Detection Using Deep Reinforcement Learning
• Dynamic data fusion using multi-input models for malware classification
• To believe or not to believe: Validating explanation fidelity for dynamic malware analysis