Malware Classification with Deep Convolutional Neural Networks

TLDR

Malware volume has surged, threatening security, and rapid classification is essential; deep convolutional neural networks have shown superior performance over shallow machine‑learning methods. We propose a CNN‑based deep learning framework to classify malware samples. The approach converts malware binaries into grayscale images and trains a CNN for classification. Experiments on the Malimg and Microsoft malware datasets achieve 98.52 % and 99.97 % accuracy, surpassing state‑of‑the‑art performance.

Abstract

In this paper, we propose a deep learning framework for malware classification. There has been a huge increase in the volume of malware in recent years which poses a serious security threat to financial institutions, businesses and individuals. In order to combat the proliferation of malware, new strategies are essential to quickly identify and classify malware samples so that their behavior can be analyzed. Machine learning approaches are becoming popular for classifying malware, however, most of the existing machine learning methods for malware classification use shallow learning algorithms (e.g. SVM). Recently, Convolutional Neural Networks (CNN), a deep learning approach, have shown superior performance compared to traditional learning algorithms, especially in tasks such as image classification. Motivated by this success, we propose a CNN-based architecture to classify malware samples. We convert malware binaries to grayscale images and subsequently train a CNN for classification. Experiments on two challenging malware classification datasets, Malimg and Microsoft malware, demonstrate that our method achieves better than the state-of-the-art performance. The proposed method achieves 98.52% and 99.97% accuracy on the Malimg and Microsoft datasets respectively.