File-level malware detection using byte streams.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• The internet hosts a growing number of documents, increasing the risk of malware infection.
• Non-executable malware poses a significant threat as users often underestimate its danger.
• Deep learning models show promise for analyzing byte streams in non-executable malware detection.

Purpose of the Study:

• To address the limitations of stream-level malware detection in deep learning models.
• To propose and validate a new method for file-level malware detection of non-executables.
• To enhance the accuracy and effectiveness of malware detection in documents.

Main Methods:

• Developing a novel aggregation technique to combine stream-level deep learning outputs.
• Applying the proposed method to analyze byte streams of non-executable files.
• Utilizing an annotated dataset for experimental validation and performance evaluation.

Main Results:

• The proposed method effectively aggregates stream-level results for file-level malware detection.
• Experimental results demonstrate a performance gain of 3.37-5.89% in F1 scores.
• The approach enhances the capability to detect malware in non-executable documents.

Conclusions:

• The developed aggregation method significantly improves file-level malware detection accuracy.
• This technique offers a more robust solution for identifying threats in non-executable files.
• The findings contribute to enhanced cybersecurity measures for document analysis.