Long short-term memory-based Malware classification method for information security. (July 2019)

• Record Type: Journal Article
• Authors: Kang, Jungho; Jang, Sejun; Li, Shuyu; Jeong, Young-Sik; Sung, Yunsick
• Is Part Of: Computers & electrical engineering. Volume 77(2019)
• Page Start: 366
• Page End: 375
• Publication Date: 2019-07
• Subjects: Malware classification -- Security -- Deep learning -- Static analysis; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2019.06.014
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: Signature-based malware detection approaches are inadequate for detecting the increasingly intelligent and large number of malware programs emerging today. Therefore, alternative approaches are required. The effects of malware can be estimated by analyzing the opcodes in its executable files. It can then be classified into families using a long short-term memory (LSTM) network. Vectorizing opcodes and application programming interface (API) function names using one-hot encoding results in high-dimensional vectors because each case is represented using one dimension. Therefore, this paper proposes a word2vec-based LSTM method to analyze opcodes and API function names using fewer dimensions. The results of opcode and API function name classification using the proposed method and one-hot encoding were compared using the Microsoft Malware Classification Challenge dataset. The proposed method showed approximately 0.5% higher performance than the one-hot encoding-based approach.