Sequential opcode embedding-based malware detection method. (March 2022)

• Record Type: Journal Article
• Authors: Kakisim, Arzu Gorgulu; Gulmez, Sibel; Sogukpinar, Ibrahim
• Is Part Of: Computers & electrical engineering. Volume 98(2022)
• Publication Date: 2022-03
• Subjects: Malware detection -- Opcode sequence -- Embedding -- Random walk -- Static analysis -- Opcode graph; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2022.107703
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: In recent years, researchers have focused on uncovering the distinctive malicious patterns of malware samples through opcode sequences using some feature learning methods to improve the accuracy of malware detection mechanisms. However, opcode sequences are often very long. Thus, the feature learning process is to be time-consuming when using the entire sequence or could be ineffective when only a partial part of the sequence is used. In this work, we propose a new malware detection approach, called Sequential Opcode Embedding-based Malware Detection (SOEMD), which aims at capturing common malicious patterns in sequential opcodes. To avoid dealing with the long opcode sequences, SOEMD uses Random walk approach with edge and node selection processes. The proposed method constructs a new vector space that consists of low-dimensional sequential opcode embeddings using an embedding method. Experimental results demonstrate that SOEMD outperforms the baseline methods and provides 100% malware detection. Graphical abstract: Highlights: A new static analysis-based malware detection method. Representation learning for malware executables. Extraction of short opcode sequences using a graph sampling approach. Construction of new sequential feature space for malware executables.