The rise of machine learning for detection and classification of malware: Research developments, trends and challenges. (1st March 2020)

• Record Type: Journal Article
• Authors: Gibert, Daniel; Mateu, Carles; Planes, Jordi
• Is Part Of: Journal of network and computer applications. Volume 153(2020)
• Publication Date: 2020-03-01
• Subjects: Malware detection -- Feature engineering -- Machine learning -- Deep learning -- Multimodal learning; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2019.102526
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: The struggle between security analysts and malware developers is a never-ending battle with the complexity of malware changing as quickly as innovation grows. Current state-of-the-art research focus on the development and application of machine learning techniques for malware detection due to its ability to keep pace with malware evolution. This survey aims at providing a systematic and detailed overview of machine learning techniques for malware detection and in particular, deep learning techniques. The main contributions of the paper are: (1) it provides a complete description of the methods and features in a traditional machine learning workflow for malware detection and classification, (2) it explores the challenges and limitations of traditional machine learning and (3) it analyzes recent trends and developments in the field with special emphasis on deep learning approaches. Furthermore, (4) it presents the research issues and unsolved challenges of the state-of-the-art techniques and (5) it discusses the new directions of research. The survey helps researchers to have an understanding of the malware detection field and of the new developments and directions of research explored by the scientific community to tackle the problem. Highlights: It presents a systematic review of M.L. approaches for malware detection. Traditional approaches are classified into static, dynamic and hybrid approaches. It provides a detailed description of the features in a traditional M.L. worflkow. It introduces new research directions such as deep learning and multimodal approaches. It discusses the research issues and challenges faced by security researchers.