Multimodal Dual-Embedding Networks for Malware Open-Set Recognition.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Malware open-set recognition (MOSR) is crucial for identifying known and novel malware families.
• Existing MOSR methods struggle due to similar feature distributions between known and unknown malware.
• Threshold-based detection in MOSR can lead to misclassification of unknown samples as known ones.

Purpose of the Study:

• To propose a novel approach, MDENet, for enhanced malware open-set recognition.
• To improve the discriminative power of malware features by leveraging multimodal information.
• To address the limitations of existing MOSR techniques in handling feature distribution similarities.

Main Methods:

• Developed multimodal dual-embedding networks (MDENet) using numeric and textual malware features.
• Utilized a multiscale CNN for numeric feature encoding into malware images.
• Employed language models for textual feature encoding, creating representative vectors.
• Implemented dual embedding into discriminative and exclusive spaces with contrastive learning and sphere regularizations.
• Enriched the MAL-100 dataset to MAL-100+ with multimodal characteristics.

Main Results:

• MDENet effectively enhances feature diversity, leading to more representative and discriminative malware representations.
• The dual-embedding strategy improves both classification of known families and detection of unknown families.
• Experimental results on Mailing and MAL-100+ datasets validate the proposed method's effectiveness.
• The enriched MAL-100+ dataset provides a valuable resource for future MOSR research.

Conclusions:

• MDENet offers a significant advancement in malware open-set recognition by effectively fusing multimodal features.
• The proposed dual-embedding approach enhances the robustness and accuracy of malware classification and detection.
• This work contributes a novel architecture and an improved dataset for the MOSR domain.