Deep neural network based malware detection using two dimensional binary program features

TLDR

Machine learning models improve with larger data, so deep neural network classifiers are expected to become increasingly important in layered network defense strategies. The paper presents a deep neural network malware detection system that achieves high detection rates with extremely low false positives and scales to large training volumes on commodity hardware. The system uses a deep neural network trained on over 400,000 binaries and includes a non‑parametric score‑adjustment method to better reflect deployment precision. The model attains a 95 % detection rate at a 0.1 % false‑positive rate, demonstrating that low‑resource, highly accurate malware detection is feasible and can uncover previously unseen threats.

Abstract

In this paper we introduce a deep neural network based malware detection system that Invincea has developed, which achieves a usable detection rate at an extremely low false positive rate and scales to real world training example volumes on commodity hardware. We show that our system achieves a 95% detection rate at 0.1% false positive rate (FPR), based on more than 400,000 software binaries sourced directly from our customers and internal malware databases. In addition, we describe a non-parametric method for adjusting the classifier's scores to better represent expected precision in the deployment environment. Our results demonstrate that it is now feasible to quickly train and deploy a low resource, highly accurate machine learning classification model, with false positive rates that approach traditional labor intensive expert rule based malware detection, while also detecting previously unseen malware missed by these traditional approaches. Since machine learning models tend to improve with larger datasizes, we foresee deep neural network classification models gaining in importance as part of a layered network defense strategy in coming years.