Fusing feature engineering and deep learning: A case study for malware classification

Machine learning has become an appealing signature-less approach to detect and classify malware because of its ability to generalize to never-before-seen samples and to handle large volumes of data. While traditional feature-based approaches rely on the manual design of hand-crafted features based o...

Descripción completa

Detalles Bibliográficos
Autores: Gibert Llauradó, Daniel, Planes Cid, Jordi, Mateu Piñol, Carles, Le, Quan
Tipo de recurso: artículo
Estado:Versión publicada
Fecha de publicación:2022
País:España
Institución:Varias* (Consorci de Biblioteques Universitáries de Catalunya, Centre de Serveis Científics i Acadèmics de Catalunya)
Repositorio:Recercat. Dipósit de la Recerca de Catalunya
OAI Identifier:oai:recercat.cat:10459.1/84137
Acceso en línea:https://doi.org/10.1016/j.eswa.2022.117957
http://hdl.handle.net/10459.1/84137
Access Level:acceso abierto
Palabra clave:Malware classification
Machine learning
Deep learning
Feature extraction
Feature fusion
id ES_c98fd224ce2a5bb12c433fb11d459be9
oai_identifier_str oai:recercat.cat:10459.1/84137
network_acronym_str ES
network_name_str España
repository_id_str
spelling Fusing feature engineering and deep learning: A case study for malware classificationGibert Llauradó, DanielPlanes Cid, JordiMateu Piñol, CarlesLe, QuanMalware classificationMachine learningDeep learningFeature extractionFeature fusionMachine learning has become an appealing signature-less approach to detect and classify malware because of its ability to generalize to never-before-seen samples and to handle large volumes of data. While traditional feature-based approaches rely on the manual design of hand-crafted features based on experts’ knowledge of the domain, deep learning approaches replace the manual feature engineering process by an underlying system, typically consisting of a neural network with multiple layers, that perform both feature learning and classification altogether. However, the combination of both approaches could substantially enhance detection systems. In this paper we present an hybrid approach to address the task of malware classification by fusing multiple types of features defined by experts and features learned through deep learning from raw data. In particular, our approach relies on deep learning to extract N-gram like features from the assembly language instructions and the bytes of malware, and texture patterns and shapelet-based features from malware’s grayscale image representation and structural entropy, respectively. These deep features are later passed as input to a gradient boosting model that combines the deep features and the hand-crafted features using an early-fusion mechanism. The suitability of our approach has been evaluated on the Microsoft Malware Classification Challenge benchmark and results show that the proposed solution achieves state-of-the-art performance and outperforms gradient boosting and deep learning methods in the literature.This project has received funding from Enterprise Ireland and the European Union’s Horizon 2020 Research and Innovation Programme under the Marie Skłodowska-Curie grant agreement No 847402, and from the Spanish Science and Innovation Ministry funded project PID2019-111544GB-C22. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of CeADAR, University College Dublin, and the University of Lleida.Elsevier202220222022info:eu-repo/semantics/articleinfo:eu-repo/semantics/publishedVersionhttps://doi.org/10.1016/j.eswa.2022.117957http://hdl.handle.net/10459.1/84137http://hdl.handle.net/10459.1/84137reponame:Recercat. Dipósit de la Recerca de Catalunyainstname:Varias* (Consorci de Biblioteques Universitáries de Catalunya, Centre de Serveis Científics i Acadèmics de Catalunya)Inglésinfo:eu-repo/grantAgreement/AEI/Plan Estatal de Investigación Científica y Técnica y de Innovación 2017-2020/PID2019-111544GB-C22Reproducció del document publicat a https://doi.org/10.1016/j.eswa.2022.117957Expert Systems with Applications, 2022, vol. 207, 117957info:eu-repo/grantAgreement/EC/H2020/847402cc-by (c) Gibert et al., 2022info:eu-repo/semantics/openAccesshttp://creativecommons.org/licenses/by/4.0/oai:recercat.cat:10459.1/841372026-05-29T05:05:01Z
dc.title.none.fl_str_mv Fusing feature engineering and deep learning: A case study for malware classification
title Fusing feature engineering and deep learning: A case study for malware classification
spellingShingle Fusing feature engineering and deep learning: A case study for malware classification
Gibert Llauradó, Daniel
Malware classification
Machine learning
Deep learning
Feature extraction
Feature fusion
title_short Fusing feature engineering and deep learning: A case study for malware classification
title_full Fusing feature engineering and deep learning: A case study for malware classification
title_fullStr Fusing feature engineering and deep learning: A case study for malware classification
title_full_unstemmed Fusing feature engineering and deep learning: A case study for malware classification
title_sort Fusing feature engineering and deep learning: A case study for malware classification
dc.creator.none.fl_str_mv Gibert Llauradó, Daniel
Planes Cid, Jordi
Mateu Piñol, Carles
Le, Quan
author Gibert Llauradó, Daniel
author_facet Gibert Llauradó, Daniel
Planes Cid, Jordi
Mateu Piñol, Carles
Le, Quan
author_role author
author2 Planes Cid, Jordi
Mateu Piñol, Carles
Le, Quan
author2_role author
author
author
dc.subject.none.fl_str_mv Malware classification
Machine learning
Deep learning
Feature extraction
Feature fusion
topic Malware classification
Machine learning
Deep learning
Feature extraction
Feature fusion
description Machine learning has become an appealing signature-less approach to detect and classify malware because of its ability to generalize to never-before-seen samples and to handle large volumes of data. While traditional feature-based approaches rely on the manual design of hand-crafted features based on experts’ knowledge of the domain, deep learning approaches replace the manual feature engineering process by an underlying system, typically consisting of a neural network with multiple layers, that perform both feature learning and classification altogether. However, the combination of both approaches could substantially enhance detection systems. In this paper we present an hybrid approach to address the task of malware classification by fusing multiple types of features defined by experts and features learned through deep learning from raw data. In particular, our approach relies on deep learning to extract N-gram like features from the assembly language instructions and the bytes of malware, and texture patterns and shapelet-based features from malware’s grayscale image representation and structural entropy, respectively. These deep features are later passed as input to a gradient boosting model that combines the deep features and the hand-crafted features using an early-fusion mechanism. The suitability of our approach has been evaluated on the Microsoft Malware Classification Challenge benchmark and results show that the proposed solution achieves state-of-the-art performance and outperforms gradient boosting and deep learning methods in the literature.
publishDate 2022
dc.date.none.fl_str_mv 2022
2022
2022
dc.type.none.fl_str_mv info:eu-repo/semantics/article
info:eu-repo/semantics/publishedVersion
format article
status_str publishedVersion
dc.identifier.none.fl_str_mv https://doi.org/10.1016/j.eswa.2022.117957
http://hdl.handle.net/10459.1/84137
http://hdl.handle.net/10459.1/84137
url https://doi.org/10.1016/j.eswa.2022.117957
http://hdl.handle.net/10459.1/84137
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.relation.none.fl_str_mv info:eu-repo/grantAgreement/AEI/Plan Estatal de Investigación Científica y Técnica y de Innovación 2017-2020/PID2019-111544GB-C22
Reproducció del document publicat a https://doi.org/10.1016/j.eswa.2022.117957
Expert Systems with Applications, 2022, vol. 207, 117957
info:eu-repo/grantAgreement/EC/H2020/847402
dc.rights.none.fl_str_mv cc-by (c) Gibert et al., 2022
info:eu-repo/semantics/openAccess
http://creativecommons.org/licenses/by/4.0/
rights_invalid_str_mv cc-by (c) Gibert et al., 2022
http://creativecommons.org/licenses/by/4.0/
eu_rights_str_mv openAccess
dc.publisher.none.fl_str_mv Elsevier
publisher.none.fl_str_mv Elsevier
dc.source.none.fl_str_mv reponame:Recercat. Dipósit de la Recerca de Catalunya
instname:Varias* (Consorci de Biblioteques Universitáries de Catalunya, Centre de Serveis Científics i Acadèmics de Catalunya)
instname_str Varias* (Consorci de Biblioteques Universitáries de Catalunya, Centre de Serveis Científics i Acadèmics de Catalunya)
reponame_str Recercat. Dipósit de la Recerca de Catalunya
collection Recercat. Dipósit de la Recerca de Catalunya
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869419381447983104
score 15,811543

Similares en LA Referencia