Malware classification for the cloud via semi-supervised transfer learning. (December 2020)

• Record Type: Journal Article
• Authors: Gao, Xianwei; Hu, Changzhen; Shan, Chun; Liu, Baoxu; Niu, Zequn; Xie, Hui
• Is Part Of: Journal of information security and applications. Volume 55(2020)
• Publication Date: 2020-12
• Subjects: Malware classification -- Transfer learning -- Assembly opcode -- Semi-supervised learning -- Privacy protection -- Cloud -- SSTL; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2020.102661
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Malware threats and privacy protection are two of the biggest challenges in the cloud computing environment. Many studies have focused on the accuracy of malware detection, but they did not sufficiently take into account the privacy protection of cloud tenants. This paper proposes a novel malware detection model, based on semi-supervised transfer learning (SSTL) for the cloud, that consists of detection, prediction, and transfer components. To protect the privacy of tenants in the public cloud, a byte classifier based on a recurrent neural network (RNN) for its detection component is designed to detect malware. However, because it is limited by the scarcity of training samples, the accuracy of the byte classifier is only 94.72% after supervised learning. An asm classifier is proposed for the prediction component, and it achieves 99.69% accuracy. The transfer component invokes the prediction component to classify an unlabeled dataset, and it combines the predicted labels and byte features of the unlabeled dataset into a new training dataset. Through the advantages of semi-supervised learning, the new dataset is transferred to the byte classifier for training again. The test results on the Kaggle malware datasets show that semi-supervised transfer learning improved the accuracy of the detection component from 94.72% to 96.9%. The improved malware detection method can not only do a better job of resolving the privacy concerns of tenants in the public cloud than other similar methods, but it can also detect malware more accurately.