GSB: GNGS and SAG-BiGRU network for malware dynamic detection.

Area of Science:

• Cybersecurity
• Machine Learning
• Data Science

Background:

• The internet's growth fuels malware evolution, posing significant cybersecurity challenges.
• Imbalanced datasets in malware detection hinder the accurate identification of rare but critical minority attack categories.
• Minority attack malware can cause substantial financial and operational losses.

Purpose of the Study:

• To address the challenge of imbalanced datasets in malware detection.
• To improve the detection rate of minority malware categories.
• To develop a more effective malware detection model that prioritizes critical threats.

Main Methods:

• Proposed the Gaussian Noise Generation Strategy (GNGS) to create a balanced dataset.
• Utilized a Self-Attention with Gate (SAG) mechanism based on the Transformer for feature extraction, filtering noise.
• Employed a Bi-directional Gated Recurrent Unit (BiGRU) network for temporal sequence feature extraction.
• Implemented a SoftMax classifier for final classification.

Main Results:

• The GNGS algorithm effectively balanced the distribution of minority malware categories.
• The SAG-BiGRU algorithm achieved an 88.7% accuracy rate in an eight-class malware classification task.
• The proposed GSB deep learning model demonstrated effectiveness on both the Alibaba Cloud and NSL-KDD datasets, indicating broad applicability.

Conclusions:

• The GNGS algorithm is a viable solution for mitigating data imbalance issues in malware detection.
• The SAG-BiGRU model offers superior performance in malware multi-classification compared to existing algorithms.
• The GSB model shows promise for effective network intrusion detection across various datasets.