Self-Supervised Vision Transformers for Malware Detection

2022-08-15 · Sachith Seneviratne, Ridwan Shariffdeen, Sanka Rasnayaka, Nuran Kasthuriarachchi

Malware detection plays a crucial role in cyber-security with the increase in malware growth and advancements in cyber-attacks. Previously unseen malware which is not determined by security vendors are often used in these attacks and it is becoming inevitable to find a solution that can self-learn from unlabeled sample data. This paper presents SHERLOCK, a self-supervision based deep learning model to detect malware based on the Vision Transformer (ViT) architecture. SHERLOCK is a novel malware detection method which learns unique features to differentiate malware from benign programs with the use of image-based binary representation. Experimental results using 1.2 million Android applications across a hierarchy of 47 types and 696 families, shows that self-supervised learning can achieve an accuracy of 97% for the binary classification of malware which is higher than existing state-of-the-art techniques. Our proposed model is also able to outperform state-of-the-art techniques for multi-class malware classification of types and family with macro-F1 score of .497 and .491 respectively.

📄 PDF Abstract BibTeX arXiv:2208.07049

Code (1)

sachith500/sherlock 공식 구현 pytorch

Tasks

Binary Classification Malware Classification Malware DetectionMalware Family DetectionMalware Type DetectionSelf-Supervised Learning

Methods 이 논문이 사용한 방법론

Attention 설명 없음

Linear Layer A Linear Layer is a projection $\mathbf{XW + b}$.

Absolute Position Encodings Absolute Position Encodings are a type of position embeddings for [Transformer-based models] where positional encodings are…

Label Smoothing Label Smoothing is a regularization technique that introduces noise for the labels. This accounts for the fact that datasets may have mistakes in them, so maximizing the…

Position-Wise Feed-Forward Layer 설명 없음

Adam 설명 없음

Dropout Dropout is a regularization technique for neural networks that drops a unit (along with connections) at training time with a specified probability $p$ (a common value is…

Softmax The Softmax output function transforms a previous layer's output into a vector of probabilities. It is commonly used for multiclass classification. Given an input vector $x$…

SETTI: A Self-supervised Adversarial Malware Detection Architecture in an IoT Environment

2022-04-16 · Marjan Golmaryami, Rahim Taheri, Zahra Pooranian, Mohammad Shojafar 외

In recent years, malware detection has become an active research topic in the area of Internet of Things (IoT) security. The principle is to exploit knowledge from large quantities of continuously generated malware. Exis…

Generative Adversarial Network Malware Detection

MADCAT: Combating Malware Detection Under Concept Drift with Test-Time Adaptation

2025-05-24 · Eunjin Roh, Yigitcan Kaya, Christopher Kruegel, Giovanni Vigna 외

We present MADCAT, a self-supervised approach designed to address the concept drift problem in malware detection. MADCAT employs an encoder-decoder architecture and works by test-time training of the encoder on a small, …

Android Malware Detection Decoder Malware Detection Test-time Adaptation

Accelerating Malware Classification: A Vision Transformer Solution

2024-09-28 · Shrey Bavishi, Shrey Modi

The escalating frequency and scale of recent malware attacks underscore the urgent need for swift and precise malware classification in the ever-evolving cybersecurity landscape. Key challenges include accurately categor…

Classification image-classification Image Classification Malware Classification+2

Packet Inspection Transformer: A Self-Supervised Journey to Unseen Malware Detection with Few Samples

2024-09-26 · Kyle Stein, Arash Mahyari, Guillermo Francia III, Eman El-Sheikh

As networks continue to expand and become more interconnected, the need for novel malware detection methods becomes more pronounced. Traditional security measures are increasingly inadequate against the sophistication of…

Few-Shot Learning Malware Detection Self-Supervised Learning Traffic Classification

Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset

2026-04-24 · Annan Fu, Hao Pei, Maryam Tanha arxiv

Android malware detectors built with machine learning often suffer from temporal bias: models are trained and evaluated without respecting apps' actual release times, inflating accuracy and weakening real-world robustnes…

Self-Supervised Learning Malware Detection