Towards time evolved malware identification using two-head neural network. (March 2022)

• Record Type: Journal Article
• Authors: Yuan, Chong; Cai, Jingxuan; Tian, Donghai; Ma, Rui; Jia, Xiaoqi; Liu, Wenmao
• Is Part Of: Journal of information security and applications. Volume 65(2022)
• Publication Date: 2022-03
• Subjects: Malware detection -- Deep learning -- Anomaly detection -- Two-head neural network; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2021.103098
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Deep learning-based malware detection plays an important role in cybersecurity in recent years. However, with the increasing complexity of malware and the continuous development of anti-detection techniques, a lot of malicious programs evolve over time. As a result, the deep learning-based methods may fail to recognize these time evolved malware samples, which poses a critical challenge to deploy the deep learning models in practice. In this paper, we first implement two well-known deep learning-based malware detection models: MalConv and TextCNN. From our experiments that divide the dataset according to the timestamp information for model training and testing, we found the detection performance of the two models both decline obviously when they process the time evolved malware. To address this problem, we propose an anomaly detection approach based on two-head neural network. This method can identify the time evolved samples. These samples would make the previous trained deep learning models misclassified. The experiments show that the malware detection accuracies can be improved by 8.62% for MalConv and 13.12% for TextCNN after the identified samples are filtered. This indicates that our method could effectively improve the usability of the pre-trained models on processing the new data. Moreover, the experimental results are well studied.