MITHRIL: Malware Classification Through Lightweight cnn and Uniform Sampling

RES2NET-MAXOUT: Image-Based Multi-Class Malware Classification with Deep Learning Models

Packed and Unpacked Malware Detection by Means of Explainable Federated Machine Learning

: The number of cybersecurity attacks has drastically increased in the last few decades. Although researchers and experts have proposed several methods to curb them, malicious actors continue to develop new techniques to perpetrate attacks. Among these techniques, attackers often use software known as a packer to obfuscate or compress executable code. Thus, it allows us to obtain a different file representation, making the analysis process more difficult. Given the widespread use of malware in companies and the need to avoid sharing sensitive data, this research article proposes a malware detection method based on Federated Machine Learning. In detail, we trained several models leveraging a publicly available dataset of Portable Executable and Object Linking and Embedding files from the Windows environment, which we converted into images using a Python script. To enhance the privacy and security of the model, we employed the zeroing norm aggregator, which zeroes to mitigate the risk of gradient leakage attacks. Moreover, we employed non-Independent and Iden-tically Distributed data to represent a real-world scenario better. Once we concluded the training phase, we also evaluated the best model on original samples and on samples processed with three state-of-the-art packers (MPRESS, BEP, and GZexe) to assess its robustness. Specifically, the baseline accuracy of 0.881 increased slightly with MPRESS (+0.003) and GZexe (+0.004). However, the BEP-packed samples showed the greatest improvement, achieving an accuracy of 0.972. Finally, we applied the Gradient-weighted Class Activation Mapping++ algorithm to highlight the image regions that influenced the classification results.

A Survey on Deep Learning Approaches for Malware Detection and Classification

Malware is a serious threat in the cybersecurity area because of its dynamic nature, the variety of malware families, stealth, propagation and the capability of evading traditional security products. Therefore, proper malware detection and classification are crucial for detecting malicious software and for securing computer systems from unauthorized access and data stealing, and for disrupting systems. This study covers all the bases when it comes to deep learning approaches for malware detection and classification. It covers the principles, different forms of malware, how to detect deep learning malware, how to represent data, obtaining features, and applications. The traditional detection methods are described with their drawbacks, namely based on signature, behavioral and heuristic methods. The report also delves into the methodologies used by deep learning to classify malware, namely CNNs and Bidirectional Long Short-Term Memory (BiLSTM) networks. BiLSTM models excel at learning sequential features from code-or behavior-related data, whereas CNN-based representation learning approaches excel at learning spatial features from malware representations. Moreover, the various detection techniques (static, dynamic and hybrid) are discussed so that their role in malware analysis can be understood. The survey identifies the current challenges and gaps in research and emphasizes the need for strong, scalable and adaptive deep-learning models to combat new malware threats and enhance cybersecurity protection.

HilEnT: Hilbert, Entropy Transformed Image Based Malware Detection

A novel malware binary to image transformation technique HilEnT is proposed based on a combination of Hilbert curve-based transformation of malware binary and the entropy feature comparison of malware file with benign and malware classes.

A Robust Deep Learning Framework for Intelligent Malware Detection

Malware has become one of the biggest threats to computer systems and digital networks, affecting individuals, businesses, and government organizations. Traditional malware detection methods mainly depend on signatures and predefined rules, making them less effective against newly developed and constantly evolving attacks. As cybercriminals continue to use advanced techniques such as code obfuscation and polymorphism, there is a growing need for smarter and faster detection methods. This project proposes a robust malware detection system using deep learning to identify both known and unknown malware with improved accuracy. The model automatically learns meaningful patterns from malware data without relying heavily on manual feature extraction. By analyzing the behavior and characteristics of malicious files, the proposed system can classify malware efficiently while reducing false alarms. The approach improves detection speed, enhances security, and supports real-time threat analysis. This makes it a reliable solution for protecting modern computer systems against rapidly changing cyber threats.

Malware detection via memory dump images: investigating the role of uneven kernel filters in CNNs with visual explainability

With the Internet becoming more accessible, protecting our digital identities has become more crucial than ever. Our devices are always online, sharing data, and exposed to numerous threats. Traditional methods of detecting malware are no longer adequate due to the rapid advancement and complexity of malware. To address these challenges, researchers have started using artificial intelligence, especially machine learning and deep learning techniques, with encouraging outcomes. One emerging approach involves converting malware binaries or memory dumps into images. However, these malware images are not recognizable to the human eye and, therefore, need to be explained in terms of how the CNNs perceive this data type. This paper applies the Grad-CAM technique to malware images collected from memory dumps to understand sufficiently how black-box CNN models make predictions with this data. Based on insights from the Grad-CAM analysis, we propose a novel CNN architecture with uneven kernel sizes that outperforms existing malware detection and classification models. We compare its performance against well-known CNN architectures, all trained and tested on malware image datasets such as Malimg, Dumpware10, MaleVis, and MalBen. Our proposed architecture achieved an impressive accuracy of 99.58% on the Malimg dataset with fewer training parameters, surpassing previous models, which achieved a maximum accuracy of 99.26% on the same dataset.