I-MAD: Interpretable Malware Detector Using Galaxy Transformer
Malware currently presents a number of serious threats to computer users. Signature-based malware detection methods are limited in detecting new malware samples that are significantly different from known ones. Therefore, machine learning-based methods have been proposed, but there are two challenges these methods face. The first is to model the full semantics behind the assembly code of malware. The second challenge is to provide interpretable results while keeping excellent detection performance. In this paper, we propose an Interpretable MAlware Detector (I-MAD) that outperforms state-of-the-art static malware detection models regarding accuracy with excellent interpretability. To improve the detection performance, I-MAD incorporates a novel network component called the Galaxy Transformer network that can understand assembly code at the basic block, function, and executable levels. It also incorporates our proposed interpretable feed-forward neural network to provide interpretations for its detection results by quantifying the impact of each feature with respect to the prediction. Experiment results show that our model significantly outperforms existing state-of-the-art static malware detection models and presents meaningful interpretations.
Code (0)
등록된 구현이 없습니다.
Tasks
BIG-bench Machine LearningMalware DetectionMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Adversarial Attacks on Transformers-Based Malware Detectors
Signature-based malware detectors have proven to be insufficient as even a small change in malignant executable code can bypass these signature-based detectors. Many machine learning-based models have been proposed to ef…
Interpreting Machine Learning Malware Detectors Which Leverage N-gram Analysis
In cyberattack detection and prevention systems, cybersecurity analysts always prefer solutions that are as interpretable and understandable as rule-based or signature-based detection. This is because of the need to tune…
BIG-bench Machine LearningInterpretable Machine LearningMalware AnalysisMalware DetectionSingle-Shot Black-Box Adversarial Attacks Against Malware Detectors: A Causal Language Model Approach
Deep Learning (DL)-based malware detectors are increasingly adopted for early detection of malicious behavior in cybersecurity. However, their sensitivity to adversarial malware variants has raised immense security conce…
Language ModelingLanguage ModellingExplainability-Guided Adversarial Attacks on Transformer-Based Malware Detectors Using Control Flow Graphs
Transformer-based malware detection systems operating on graph modalities such as control flow graphs (CFGs) achieve strong performance by modeling structural relationships in program behavior. However, their robustness …
Malware DetectionTowards Interpretable Ensemble Learning for Image-based Malware Detection
Deep learning (DL) models for image-based malware detection have exhibited their capability in producing high prediction accuracy. But model interpretability is posing challenges to their widespread application in securi…
Ensemble LearningMalware Detection