Representation of PE Files using LSTM Networks

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21240%2F21%3A00347174" target="_blank" >RIV/68407700:21240/21:00347174 - isvavai.cz</a>

Result on the web

<a href="https://www.insticc.org/node/TechnicalProgram/icissp/2021/presentationDetails/102571" target="_blank" >https://www.insticc.org/node/TechnicalProgram/icissp/2021/presentationDetails/102571</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.5220/0010257105160525" target="_blank" >10.5220/0010257105160525</a>

Result language

angličtina

Original language name

Representation of PE Files using LSTM Networks

Original language description

An ever-growing number of malicious attacks on IT infrastructures calls for new and efficient methods of protection. In this paper, we focus on malware detection using the Long Short-Term Memory (LSTM) as a preprocessing tool to increase the classification accuracy of machine learning algorithms. To represent the malicious and benign programs, we used features extracted from files in the PE file format. We created a large dataset on which we performed common feature preparation and feature selection techniques. With the help of various LSTM and Bidirectional LSTM (BLSTM) network architectures, we further transformed the collected features and trained other supervised ML algorithms on both transformed and vanilla datasets. Transformation by deep (4 hidden layers) versions of LSTM and BLSTM networks performed well and decreased the error rate of several state-of-the-art machine learning algorithms significantly. For each machine learning algorithm considered in our experiments, the LSTM-based transformation of the feature space results in decreasing the corresponding error rate by more than 58.60 %, in comparison when the feature space was not transformed using LSTM network.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/EF16_019%2F0000765" target="_blank" >EF16_019/0000765: Research Center for Informatics</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Publication year

2021

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Proceedings of the 7th International Conference on Information Systems Security and Privacy

ISBN

978-989-758-491-6

ISSN

2184-4356

e-ISSN

—

Number of pages

10

Pages from-to

516-525

Publisher name

SciTePress

Place of publication

Madeira

Event location

Vídeň / Virtuální

Event date

Feb 11, 2021

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

000664076200052