ISAnWin: inductive generalized zero-shot learning using deep CNN for malware detection across windows and android...

Area of Science:

• Cybersecurity
• Machine Learning
• Computer Science

Background:

• Effective malware detection is crucial for digital security against evolving cyber threats.
• Data scarcity, especially for cross-family malware detection, presents a significant obstacle.
• Zero-shot learning offers a promising approach to overcome data limitations in malware classification.

Purpose of the Study:

• To propose a novel ConvNet-6 architecture for Siamese Neural Networks to enable zero-shot learning in malware detection.
• To address the challenge of limited labeled training data in identifying diverse malware families.
• To evaluate the model's performance and generalizability on unseen malware variants.

Main Methods:

• Developed a ConvNet-6 architecture integrated into Siamese Neural Networks.
• Employed a zero-shot learning strategy, training the model with a single labeled sample per sub-family.
• Conducted experiments on diverse datasets including Android and Portable Executable malware families.

Main Results:

• Achieved 82% accuracy on the test dataset, demonstrating effective detection of novel malware variants.
• Showcased model transferability by testing on a Portable Executable dataset after training on Android malware, with consistent performance.
• Validated the potential of deep convolutional neural networks (CNNs) in Siamese networks for cross-family malware detection.

Conclusions:

• The proposed ConvNet-6 architecture in Siamese networks facilitates effective zero-shot learning for cross-family malware detection.
• The model demonstrates strong generalization capabilities and consistent performance even with minimal labeled training data.
• This approach holds significant potential for enhancing cybersecurity defenses against sophisticated and emerging malware threats.