Related Experiment Video
Updated: Dec 29, 2025
08:20
Author Spotlight: AI-Driven Trypanosome Species Detection from Microscopic Images
Published on: October 27, 2023
2.3K
Deep feature transfer learning for trusted and automated malware signature generation in private cloud environments
Daniel Nahmias1, Aviad Cohen1, Nir Nissim2
1Malware Lab, Cyber Security Research Center, Ben-Gurion University of the Negev, Israel; Department of Software and Information Systems Engineering, Ben-Gurion University of the Negev, Israel.
Summary
This study introduces TrustSign, a new method for automatic malware signature generation using deep learning features from memory. It efficiently detects fileless malware and achieves high classification accuracy without manual intervention.
Area of Science:
- Cybersecurity
- Machine Learning
- Deep Learning
Background:
- Traditional malware signature generation relies on static/dynamic analysis of executables, facing limitations with fileless malware and process manipulation.
- Existing methods often require manual feature engineering and expert involvement, increasing time and cost.
Purpose of the Study:
- To introduce TrustSign, a novel, trusted, and automated method for malware signature generation.
- To overcome the limitations of traditional methods by analyzing malware in volatile memory.
- To enable efficient detection of fileless malware and reduce signature generation time.
Main Methods:
- Leveraging high-level deep features from a VGG-19 neural network pretrained on ImageNet.
- Analyzing malicious processes in a trusted cloud environment, independent of the malware's executable.
- Utilizing unsupervised learning for signature generation, eliminating the need for feature engineering or retraining.
Main Results:
- Generated signatures are impervious to process state changes over time.
- Achieved up to 99.5% classification accuracy when using TrustSign signatures with supervised classifiers.
- Demonstrated capability in signing fileless malware.
Conclusions:
- TrustSign offers a novel, efficient, and automated approach to malware signature generation.
- The method enhances security by enabling detection of sophisticated and fileless threats.
- Deep feature transfer from pre-trained models presents a powerful paradigm for cybersecurity applications.