Learning the PE Header, Malware Detection with Minimal Domain Knowledge
Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge, namely byte n-grams and strings. In this work we explore the feasibility of applying neural networks to malware detection and feature learning. We do this by restricting ourselves to a minimal amount of domain knowledge in order to extract a portion of the Portable Executable (PE) header. By doing this we show that neural networks can learn from raw bytes without explicit feature construction, and perform even better than a domain knowledge approach that parses the PE header into explicit features.
Code (2)
Tasks
Malware DetectionSimilar Papers 제목 키워드 기반
An Efficient Approach For Malware Detection Using PE Header Specification
Following the dramatic growth of malware and the essential role of computer systems in our daily lives, the security of computer systems and the existence of malware detection systems become …
BIG-bench Machine LearningMalware DetectionTowards Novel Malicious Packet Recognition: A Few-Shot Learning Approach
As the complexity and connectivity of networks increase, the need for novel malware detection approaches becomes imperative. Traditional security defenses are becoming less effective against the advanced tactics of today…
Few-Shot LearningLanguage ModellingLarge Language ModelMalware DetectionTrident: Improving Malware Detection with LLMs and Behavioral Features
Traditionally, machine learning methods for PE malware detection have relied on static features like byte histograms, string information, and PE header contents. One barrier to incorporating dynamic analysis features has…
Malware DetectionActive LearningAdversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection
Recent work has shown that adversarial Windows malware samples - referred to as adversarial EXEmples in this paper - can bypass machine learning-based detection relying on static code analysis by perturbing relatively fe…
BIG-bench Machine LearningMalware DetectionA Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries
We consider the problem of generating adversarial malware by a cyber-attacker where the attacker's task is to strategically modify certain bytes within existing binary malware files, so that the modified files are able t…
BIG-bench Machine Learning