A Lean Transformer Model for Dynamic Malware Analysis and Detection

Malware is a fast-growing threat to the modern computing world and existing lines of defense are not efficient enough to address this issue. This is mainly due to the fact that many prevention solutions rely on signature-based detection methods that can easily be circumvented by hackers. Therefore,...

Full description

Saved in:
Bibliographic Details
Published inarXiv.org
Main Authors Quertier, Tony, Marais, Benjamin, Barrué, Grégoire, Morucci, Stéphane, Azé, Sévan, Salladin, Sébastien
Format Paper
LanguageEnglish
Published Ithaca Cornell University Library, arXiv.org 05.08.2024
Subjects
Application programming interface
Computer architecture
Constraining
Cybersecurity
Generative artificial intelligence
Large language models
Malware
Natural language processing
Neural networks
Sequences
Transformers
Online AccessGet full text

Cover

More Information
Summary:Malware is a fast-growing threat to the modern computing world and existing lines of defense are not efficient enough to address this issue. This is mainly due to the fact that many prevention solutions rely on signature-based detection methods that can easily be circumvented by hackers. Therefore, there is a recurrent need for behavior-based analysis where a suspicious file is ran in a secured environment and its traces are collected to reports for analysis. Previous works have shown some success leveraging Neural Networks and API calls sequences extracted from these execution reports. Recently, Large Language Models and Generative AI have demonstrated impressive capabilities mainly in Natural Language Processing tasks and promising applications in the cybersecurity field for both attackers and defenders. In this paper, we design an Encoder-Only model, based on the Transformers architecture, to detect malicious files, digesting their API call sequences collected by an execution emulation solution. We are also limiting the size of the model architecture and the number of its parameters since it is often considered that Large Language Models may be overkill for specific tasks such as the one we are dealing with hereafter. In addition to achieving decent detection results, this approach has the advantage of reducing our carbon footprint by limiting training and inference times and facilitating technical operations with less hardware requirements. We also carry out some analysis of our results and highlight the limits and possible improvements when using Transformers to analyze malicious files.
ISSN:2331-8422