Channel Features and API Frequency-Based Transformer Model for Malware Identification.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Malicious software (malware) presents ongoing threats to information security.
• API call sequences are effective for malware identification but challenged by evasion techniques like obfuscation.
• Existing methods struggle with complex API sequences and subtle malware variations.

Purpose of the Study:

• To introduce CAFTrans, a novel transformer-based model for enhanced malware detection.
• To improve the accuracy of identifying malware, including unknown variants and adversarial attacks.
• To address the limitations of current methods in handling sophisticated malware evasion tactics.

Main Methods:

• Developed CAFTrans, a transformer model incorporating a one-dimensional channel attention module (1D-CAM) for improved API call vector feature correlation.
• Implemented a word frequency reinforcement module to preserve crucial low-frequency API features.
• Integrated Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks to capture intricate API relationships.

Main Results:

• CAFTrans achieved state-of-the-art performance on the mal-api-2019 dataset.
• The model attained an F1 score of 0.65252 and an Area Under the Curve (AUC) of 0.8913.
• Demonstrated superior accuracy in distinguishing malware types and recognizing unknown samples.

Conclusions:

• CAFTrans significantly enhances malware detection accuracy by refining API feature embedding and capturing complex relationships.
• The model shows improved capabilities in identifying diverse malware, including zero-day threats and adversarial samples.
• Findings highlight the potential of transformer-based architectures with attention mechanisms for robust cybersecurity solutions.