Malware Detection using Machine Learning and Deep Learning

Abstract

Research shows that over the last decade, malware has been growing exponentially, causing substantial financial losses to various organizations. Different anti-malware companies have been proposing solutions to defend attacks from these malware. The velocity, volume, and the complexity of malware are posing new challenges to the anti-malware community. Current state-of-the-art research shows that recently, researchers and anti-virus organizations started applying machine learning and deep learning methods for malware analysis and detection. We have used opcode frequency as a feature vector and applied unsupervised learning in addition to supervised learning for malware classification. The focus of this tutorial is to present our work on detecting malware with 1) various machine learning algorithms and 2) deep learning models. Our results show that the Random Forest outperforms Deep Neural Network with opcode frequency as a feature. Also in feature reduction, Deep Auto-Encoders are overkill for the dataset, and elementary function like Variance Threshold perform better than others. In addition to the proposed methodologies, we will also discuss the additional issues and the unique challenges in the domain, open research problems, limitations, and future directions.

11 Pages and 3 Figures

References in corpus (3)

• DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification
• Comparison of Deep Learning and the Classical Machine Learning Algorithm for the Malware Detection
• An investigation of a deep learning based malware detection system

Cited by in corpus (5)

• Robust Android Malware Detection System against Adversarial Attacks using Q-Learning
• Deep Reinforcement Learning for Cybersecurity Threat Detection and Protection: A Review
• Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning
• Assessment of the Relative Importance of different hyper-parameters of LSTM for an IDS
• DRo: A data-scarce mechanism to revolutionize the performance of Deep Learning based Security Systems