A Malware Family Classification Approach Based on Deep Sequence Modeling

Abstract

In cyber networks, malware can come in various forms and different families. Classifying malware into families helps respond to specific threats more effectively. Because the executable files contain instructions and opcodes to identify types of malwares, presenting in sequential data. Sequence learning models are necessary for improving performance of malware family classification. In this work, We proposed hybrid models based on a one-dimensional convolutional neural network and bidirectional long short-term memory where one dimensional convolutional neural network  works as a preprocessing mechanism in the extracting malware features from raw data and bidirectional long short-term memory networks process the sequential data in both forward and backward directions. Simulating results shown that our proposal was able to classify 21 malware families with training and testing accuracy 95%, significantly better than one directional convolutional neuron network, training accuracy with 98% and testing accuracy 91%. Similarity, loss of our model in the training and the testing is decreased smoothly, compared to one dimension convolutional neuron network.