Skip to main content

Ensemble Malware Classification Using Neural Networks

  • Conference paper
  • First Online:
Multimedia Communications, Services and Security (MCSS 2020)

Abstract

This work presents an experimental study of malware classification using the Microsoft Malware Classification Challenge 2015 dataset. We combine the approach of the winning solution to the Microsoft Malware Classification Challenge with the neural network approach. Using a combination of n-grams features for both assembly (asm) and byte code enables us to significantly improve the result. By mixing multiple approaches, we are able to get the best log-loss result of 0.0025, so far. This comes mostly from the classical XGBoost method with n-gram contributions from the binary and assembly code. However, understanding this result is still incomplete. The standard neural network approaches (even with LSTM) alone give poorer results compared to the XGBoost, based on mostly n-gram. It is not clear why adding 6-grams to the binary code analysis does not improve results. There are many more options to be tested in the future, in particular networks.

Supported by PUT statutory funds. One of the authors (CJ) acknowledges the NVIDIA GPU Grant of Quadro P6000 card.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save

Springer+ Basic
EUR 32.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or Ebook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    https://paperswithcode.com/sota/question-answering-on-squad20.

References

  1. Ahmadi, M., Ulyanov, D., Semenov, S., Trofimov, M., Giacinto, G.: Novel feature extraction, selection and fusion for effective malware family classification. In: Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy, CODASPY 2016, pp. 183–194 (2016). https://doi.org/10.1145/2857705.2857713

  2. Bengio, Y., Ducharme, R., Vincent, P., Janvin, C.: A neural probabilistic language model. J. Mach. Learn. Res. 3, 1137–1155 (2003). http://jmlr.org/papers/v3/bengio03a.html

  3. Chelba, C., Norouzi, M., Bengio, S.: N-gram language modeling using recurrent neural network estimation. CoRR abs/1703.10724 (2017)

    Google Scholar 

  4. Cianflone, A., Kosseim, L.: N-gram and neural language models for discriminating similar languages. CoRR abs/1708.03421 (2017)

    Google Scholar 

  5. Devlin, J., Chang, M., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirectional transformers for language understanding. CoRR abs/1810.04805 (2018). http://arxiv.org/abs/1810.04805

  6. Gibert, D., Mateu, C., Planes, J., Vicens, R.: Using convolutional neural networks for classification of malware represented as images. J. Comput. Virol. Hacking Tech. 15(1), 15–28 (2018). https://doi.org/10.1007/s11416-018-0323-0

    Article  Google Scholar 

  7. Le, Q., Boydell, O., Mac Namee, B., Scanlon, M.: Deep learning at the shallow end: malware classification for non-domain experts. Digit. Invest. 26, S118–S126 (2018)

    Article  Google Scholar 

  8. Li, M.Q., Fung, B.C.M., Charland, P., Ding, S.H.H.: I-MAD: a novel interpretable malware detector using hierarchical transformer. CoRR abs/1909.06865 (2019)

    Google Scholar 

  9. Trofimov, M., Dmitry Ulyanov, S.S.: Kaggle ‘Microsoft malware classification challenge’ 3rd place solution. https://github.com/geffy/kaggle-malware

  10. Narayanan, B.N., Davuluru, V.S.P.: Ensemble malware classification system using deep neural networks. Electronics 9, 721 (2020). https://doi.org/10.3390/electronics9050721

  11. Pieczynski, D., Jedrzejek, C.: Malware detection using black-box neural method. In: Proceedings of MISSI - Multimedia and Network Information Systems 2018, pp. 180–189 (2018). https://doi.org/10.1007/978-3-319-98678-4_20

  12. Raff, E., et al.: An investigation of byte n-gram features for malware classification. J. Comput. Virol. Hacking Tech. 14(1), 1–20 (2016). https://doi.org/10.1007/s11416-016-0283-1

    Article  MathSciNet  Google Scholar 

  13. Ronen, R., Radu, M., Feuerstein, C., Yom-Tov, E., Ahmadi, M.: Microsoft malware classification challenge. CoRR abs/1802.10135 (2018)

    Google Scholar 

  14. Shabtai, A., Moskovitch, R., Feher, C., Dolev, S., Elovici, Y.: Detecting unknown malicious code by applying classification techniques on opcode patterns. Secur. Informat. 1(1), 1 (2012). https://doi.org/10.1186/2190-8532-1-1

    Article  Google Scholar 

  15. Simopoulos, C.M.A., Weretilnyk, E.A., Golding, G.B.: Prediction of plant lncRNA by ensemble machine learning classifiers. BMC Genom. 19(1), 316 (2018). https://doi.org/10.1186/s12864-018-4665-2

    Article  Google Scholar 

  16. Vaswani, A., et al.: Attention is all you need. In: Annual Conference on Neural Information Processing Systems 2017, pp. 5998–6008 (2017). http://papers.nips.cc/paper/7181-attention-is-all-you-need

  17. Wang, X., Liu, J., Chen, Q.: Big 2015 Microsoft malware classification challenge, first place say no to overfitting. https://github.com/xiaozhouwang/kaggle_Microsoft_Malware

  18. Yan, J., Qi, Y., Rao, Q.: Detecting malware with an ensemble method based on deep neural network. Sec. Commun. Netw. 2018 (2018). https://doi.org/10.1155/2018/7247095

  19. Zak, R., Raff, E., Nicholas, C.: What can n-grams learn for malware detection? In: 12th International Conference on Malicious and Unwanted Software, MALWARE 2017, Fajardo, PR, USA, pp. 109–118 (2017). https://doi.org/10.1109/MALWARE.2017.8323963

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Czeslaw Jedrzejek .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Wyrwinski, P., Dutkiewicz, J., Jedrzejek, C. (2020). Ensemble Malware Classification Using Neural Networks. In: Dziech, A., Mees, W., Czyżewski, A. (eds) Multimedia Communications, Services and Security. MCSS 2020. Communications in Computer and Information Science, vol 1284. Springer, Cham. https://doi.org/10.1007/978-3-030-59000-0_10

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-59000-0_10

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-58999-8

  • Online ISBN: 978-3-030-59000-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics