A Malicious Code Detection Method Based on Stacked Depthwise Separable Convolutions and Attention Mechanism.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Traditional malware detection methods struggle with weak model generalization and limited capacity adaptation.
• Existing approaches often fail to effectively balance model generalization and adaptation.
• There is a need for advanced techniques to improve malware detection robustness.

Purpose of the Study:

• To propose a novel malware detection approach, CoAtNet, combining stacked depthwise separable convolutions and self-attention.
• To enhance model generalization and capacity adaptation in malware detection.
• To validate the effectiveness of CoAtNet against established malware detection models.

Main Methods:

• Malicious code is transformed into grayscale images for processing.
• A detection model employing stacked depthwise separable convolutions and a self-attention mechanism is utilized.
• Comparative experiments were conducted using the Malimg and augmented Blended+ datasets.

Main Results:

• CoAtNet demonstrated superior performance in accuracy and generalization compared to XceptionNet, EfficientNetB0, ResNet50, VGG16, DenseNet169, and InceptionResNetV2.
• The model effectively extracts essential features from malicious software images.
• Experimental validation confirmed the enhanced capabilities of the proposed method.

Conclusions:

• The CoAtNet approach effectively addresses limitations in traditional malware detection.
• Stacked depthwise separable convolutions and self-attention significantly improve detection accuracy and robustness.
• This research offers a promising solution for advanced malware detection systems.