Malware Detection by Eating a Whole EXE

About

In this work we introduce malware detection from raw byte sequences as a fruitful research area to the larger machine learning community. Building a neural network for such a problem presents a number of interesting challenges that have not occurred in tasks such as image processing or NLP. In particular, we note that detection from raw bytes presents a sequence problem with over two million time steps and a problem where batch normalization appear to hinder the learning process. We present our initial work in building a solution to tackle this problem, which has linear complexity dependence on the sequence length, and allows for interpretable sub-regions of the binary to be identified. In doing so we will discuss the many challenges in building a neural network to process data at this scale, and the methods we used to work around them.

Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, Charles Nicholas · 2017

Related benchmarks

Task	Dataset	Result
Malware Detection	Malware Detection dataset	Latency (s)0.0021	21
Malware Detection	Sleipnir2 (test)	Accuracy (Clean)98.9	7
Malware Detection	BODMAS (September 2019 to September 2020)	Accuracy (09/2019)92.39	7
Malware Detection	AI-Gen-Malware	Accuracy72.4	6
Malware Detection	EMBER 10,000 sample	Accuracy96.8	6
Malware Detection	Set A real malware with constant padding attack 2020	Accuracy29.2	6
Malware Detection	EMBER (test)	Correct Allocations Count—	6
Binary-level classification	held-out (test)	Accuracy94.2	4
Malware Detection	VTFeed (test)	Clean Accuracy98.9	3