Transfer Learning for Image-Based Malware Detection for IoT.

Area of Science:

• Cybersecurity and Machine Learning
• Deep Learning for Malware Detection

Background:

• The proliferation of online activity and the Internet of Things (IoT) has led to a significant rise in cyberattacks, with malware affecting numerous households.
• Current malware detection methods often rely on deep learning with visualization, which can be resource-intensive and prone to overfitting with large datasets.
• Existing deep learning models face challenges in generalizing effectively without overfitting, especially with complex architectures and large datasets.

Purpose of the Study:

• To propose a novel ensemble model, Stacked Ensemble-autoencoder, GRU, and MLP (SE-AGM), for efficient and accurate malware classification.
• To investigate the suitability of the Gated Recurrent Unit (GRU) model for malware detection, a less commonly used approach in this domain.
• To reduce the time and resource consumption in malware detection by utilizing a concise set of essential features.

Main Methods:

• Developed a novel stacked ensemble model (SE-AGM) combining autoencoder, GRU, and MLP lightweight neural networks.
• Extracted 25 essential encoded features from the MalImg dataset using a CNN-based transfer learning model trained from scratch.
• Employed data augmentation techniques to enhance the classification of grayscale malware images.

Main Results:

• The proposed SE-AGM model achieved an average accuracy of 99.43% on the benchmark MalImg dataset.
• The SE-AGM model demonstrated superior performance compared to existing malware detection approaches.
• The stacked ensemble method, where intermediate model outputs feed into subsequent models, effectively refined features.

Conclusions:

• The SE-AGM model offers a highly accurate and efficient solution for malware classification.
• The study validates the effectiveness of lightweight neural networks and feature engineering in cybersecurity.
• The proposed method provides a competitive alternative to existing, more resource-intensive malware detection techniques.