Attention-Based Malware Detection Model by Visualizing Latent Features Through Dynamic Residual Kernel Network

• Published in: Sensors (Basel, Switzerland) Vol. 24; no. 24; p. 7953
• Main Authors: Basak, Mainak, Kim, Dong-Wook, Han, Myung-Mook, Shin, Gun-Yoon
• Format: Journal Article
• Language: English
• Published: Switzerland MDPI AG 01.12.2024
• Subjects: Accuracy; Algorithms; Analysis; Classification; Decision trees; Efficiency; explainable AI; Labeling; Machine learning; Malware; malware analysis; Methods; Neural networks; residual network; Spyware; visual analysis; malware analysis; explainable AI; residual network; visual analysis
• ISSN: 1424-8220; 1424-8220
• DOI: 10.3390/s24247953

In recent years, significant research has been directed towards the taxonomy of malware variants. Nevertheless, certain challenges persist, including the inadequate accuracy of sample classification within similar malware families, elevated false-negative rates, and significant processing time and resource consumption. Malware developers have effectively evaded signature-based detection methods. The predominant static analysis methodologies employ algorithms to convert the files. The analytic process is contingent upon the tool’s functionality; if the tool malfunctions, the entire process is obstructed. Most dynamic analysis methods necessitate the execution of a binary file within a sandboxed environment to examine its behavior. When executed within a virtual environment, the detrimental actions of the file might be easily concealed. This research examined a novel method for depicting malware as images. Subsequently, we trained a classifier to categorize new malware files into their respective classifications utilizing established neural network methodologies for detecting malware images. Through the process of transforming the file into an image representation, we have made our analytical procedure independent of any software, and it has also become more effective. To counter such adversaries, we employ a recognized technique called involution to extract location-specific and channel-agnostic features of malware data, utilizing a deep residual block. The proposed approach achieved remarkable accuracy of 99.5%, representing an absolute improvement of 95.65% over the equal probability benchmark.