Aggressive embedding dropout in embedding-based malware detection
Malware is detected using an embedding-based machine learning model. The model generates embeddings using byte n-grams. A feature importance operation reveals that only a subset of the embeddings is required to detect malware. In some cases, even a single embedding is adequate and retains 99% detection capabilities. An aggressive embedding dropout operation is implemented that ignores lesser-important embeddings. Because perhaps only one, or a few, embeddings need be determined, malware detection is greatly simplified. Malware detection is greatly simplified and need not calculate full-sized embeddings. A malware detection service runs quicker, and just as capably, while consuming less resources.
1 . A method executed by a computer that detects a malware, comprising:
receiving, by the computer, n-gram embeddings generated by a byte n-gram embedding model using byte n-grams;
determining, by the computer, a descriptive n-gram embedding of the n-gram embeddings by ranking the n-gram embeddings according to a feature importance operation; and
detecting, by the computer, the malware using a malware classifier trained using an aggressive embedding dropout operation that drops the n-gram embeddings according to a rank determined by the feature importance operation.
2 . The method of claim 1 , further comprising identifying the descriptive n-gram embedding by ranking positional indices associated with the n-gram embedding.
3 . The method of claim 1 , further comprising identifying the descriptive n-gram embedding by ranking values associated with the n-gram embeddings.
4 . The method of claim 1 , further comprising selecting an n-gram embedder according to the descriptive n-gram embedding.
5 . The method of claim 1 , further comprising selecting an n-gram feature extractor according to the descriptive n-gram embedding.
6 . The method of claim 1 , further comprising classifying a byte buffer.
7 . The method of claim 1 , further comprising detecting the malware associated with bits in a byte buffer.
8 . The method of claim 1 , wherein the determining of the descriptive n-gram embedding further comprises applying a principal components analysis to the n-gram embeddings.
9 . At least one computer system that detects a malware, comprising:
at least one central processing unit; and
at least one memory device storing instructions that, when executed by the at least one central processing unit, perform operations, the operations comprising:
receiving n-gram embeddings associated with an embedding vector generated by a byte n-gram embedding model using byte n-grams;
determining a hyperparameter by ranking positional indices associated with the embedding vector according to a feature importance operation; and
detecting the malware using a malware classifier trained using an aggressive embedding dropout operation that drops the n-gram embeddings according to the hyperparameter determined by the feature importance operation.
10 . The at least one computer system of claim 9 , wherein the operations further comprise identifying the descriptive n-gram embedding by the ranking of the positional indices.
11 . The at least one computer system of claim 9 , wherein the operations further comprise identifying the descriptive n-gram embedding by ignoring at least one of the positional indices.
12 . The at least one computer system of claim 9 , wherein the operations further comprise selecting an n-gram embedder according to the descriptive n-gram embedding.
13 . The at least one computer system of claim 9 , wherein the operations further comprise selecting an n-gram feature extractor according to the descriptive n-gram embedding.
14 . The at least one computer system of claim 9 , wherein the operations further comprise classifying a byte buffer.
15 . The at least one computer system of claim 9 , wherein the operations further comprise detecting the malware associated with bits in a byte buffer.
16 . The at least one computer system of claim 9 , wherein the operations further comprise applying a principal components analysis to the n-gram embeddings.