Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware
Malware authors apply different techniques of control flow obfuscation, in order to create new malware variants to avoid detection. Existing Siamese neural network (SNN)-based malware detection methods fail to correctly classify different malware families when such obfuscated malware samples are pre...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-06-01
|
| Series: | Future Internet |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1999-5903/15/6/214 |
| _version_ | 1827737308935225344 |
|---|---|
| author | Jinting Zhu Julian Jang-Jaccard Amardeep Singh Paul A. Watters Seyit Camtepe |
| author_facet | Jinting Zhu Julian Jang-Jaccard Amardeep Singh Paul A. Watters Seyit Camtepe |
| author_sort | Jinting Zhu |
| collection | DOAJ |
| description | Malware authors apply different techniques of control flow obfuscation, in order to create new malware variants to avoid detection. Existing Siamese neural network (SNN)-based malware detection methods fail to correctly classify different malware families when such obfuscated malware samples are present in the training dataset, resulting in high false-positive rates. To address this issue, we propose a novel task-aware few-shot-learning-based Siamese Neural Network that is resilient against the presence of malware variants affected by such control flow obfuscation techniques. Using the average entropy features of each malware family as inputs, in addition to the image features, our model generates the parameters for the feature layers, to more accurately adjust the feature embedding for different malware families, each of which has obfuscated malware variants. In addition, our proposed method can classify malware classes, even if there are only one or a few training samples available. Our model utilizes few-shot learning with the extracted features of a pre-trained network (e.g., VGG-16), to avoid the bias typically associated with a model trained with a limited number of training samples. Our proposed approach is highly effective in recognizing unique malware signatures, thus correctly classifying malware samples that belong to the same malware family, even in the presence of obfuscated malware variants. Our experimental results, validated by N-way on N-shot learning, show that our model is highly effective in classification accuracy, exceeding a rate >91%, compared to other similar methods. |
| first_indexed | 2024-03-11T02:26:53Z |
| format | Article |
| id | doaj.art-efd4e2acc61b4e26a4ed324afe3f9886 |
| institution | Directory Open Access Journal |
| issn | 1999-5903 |
| language | English |
| last_indexed | 2024-03-11T02:26:53Z |
| publishDate | 2023-06-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Future Internet |
| spelling | doaj.art-efd4e2acc61b4e26a4ed324afe3f98862023-11-18T10:30:31ZengMDPI AGFuture Internet1999-59032023-06-0115621410.3390/fi15060214Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated MalwareJinting Zhu0Julian Jang-Jaccard1Amardeep Singh2Paul A. Watters3Seyit Camtepe4Cybersecurity Lab, Massey University, Auckland 0632, New ZealandCybersecurity Lab, Massey University, Auckland 0632, New ZealandCybersecurity Lab, Massey University, Auckland 0632, New ZealandCyberstronomy Pty Ltd., Melbourne 3086, AustraliaData61, Commonwealth Scientific and Industrial Research Organisation (CSIRO), Epping 1710, AustraliaMalware authors apply different techniques of control flow obfuscation, in order to create new malware variants to avoid detection. Existing Siamese neural network (SNN)-based malware detection methods fail to correctly classify different malware families when such obfuscated malware samples are present in the training dataset, resulting in high false-positive rates. To address this issue, we propose a novel task-aware few-shot-learning-based Siamese Neural Network that is resilient against the presence of malware variants affected by such control flow obfuscation techniques. Using the average entropy features of each malware family as inputs, in addition to the image features, our model generates the parameters for the feature layers, to more accurately adjust the feature embedding for different malware families, each of which has obfuscated malware variants. In addition, our proposed method can classify malware classes, even if there are only one or a few training samples available. Our model utilizes few-shot learning with the extracted features of a pre-trained network (e.g., VGG-16), to avoid the bias typically associated with a model trained with a limited number of training samples. Our proposed approach is highly effective in recognizing unique malware signatures, thus correctly classifying malware samples that belong to the same malware family, even in the presence of obfuscated malware variants. Our experimental results, validated by N-way on N-shot learning, show that our model is highly effective in classification accuracy, exceeding a rate >91%, compared to other similar methods.https://www.mdpi.com/1999-5903/15/6/214Siamese neural networkmeta-learningmalware classificationcode obfuscationfew-shot learning |
| spellingShingle | Jinting Zhu Julian Jang-Jaccard Amardeep Singh Paul A. Watters Seyit Camtepe Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware Future Internet Siamese neural network meta-learning malware classification code obfuscation few-shot learning |
| title | Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware |
| title_full | Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware |
| title_fullStr | Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware |
| title_full_unstemmed | Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware |
| title_short | Task-Aware Meta Learning-Based Siamese Neural Network for Classifying Control Flow Obfuscated Malware |
| title_sort | task aware meta learning based siamese neural network for classifying control flow obfuscated malware |
| topic | Siamese neural network meta-learning malware classification code obfuscation few-shot learning |
| url | https://www.mdpi.com/1999-5903/15/6/214 |
| work_keys_str_mv | AT jintingzhu taskawaremetalearningbasedsiameseneuralnetworkforclassifyingcontrolflowobfuscatedmalware AT julianjangjaccard taskawaremetalearningbasedsiameseneuralnetworkforclassifyingcontrolflowobfuscatedmalware AT amardeepsingh taskawaremetalearningbasedsiameseneuralnetworkforclassifyingcontrolflowobfuscatedmalware AT paulawatters taskawaremetalearningbasedsiameseneuralnetworkforclassifyingcontrolflowobfuscatedmalware AT seyitcamtepe taskawaremetalearningbasedsiameseneuralnetworkforclassifyingcontrolflowobfuscatedmalware |