Methods and apparatus for malware classification through convolutional neural networks using raw bytes
Methods, apparatus, systems, and articles of manufacture are disclosed. An example apparatus includes at least one memory, instructions; and processor circuitry to execute the instructions to train a neural network with a plurality of raw byte data samples, perform feature extraction on ones of the plurality of raw byte data samples, determine whether ones of the plurality of raw byte data samples are clean or malicious using the extracted features, and determine a family of malware to which an identified malicious sample belongs.
1 . An apparatus comprising:
at least one memory;
instructions; and
at least one processor circuit to execute the instructions to:
train a first neural network with a plurality of raw byte data samples, wherein the plurality of raw byte data samples include both clean and malicious samples, wherein the plurality of raw byte data samples are not preprocessed;
perform feature extraction using one or more raw byte data samples of the plurality of raw byte data samples and a rectified linear unit (RELU) to obtain extracted features, the extracted features including malware static features;
determine whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious using the extracted features; and
provide the malware static features as input to a second neural network to determine a family of malware to which an identified malicious sample belongs by using a scaled exponential linear unit (SELU).
2 . The apparatus of claim 1 , wherein a feature-based classifier is used to determine whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious.
3 . The apparatus of claim 1 , wherein a feature-based classifier is used to determine the family of malware to which the identified malicious sample belongs.
4 . The apparatus of claim 1 , wherein the first neural network is trained using a supervised learning algorithm such as one or more of a Regression, Decision Tree, Random forest, k-nearest neighbors (KNN), or Logistic Regression algorithm.
5 . The apparatus of claim 1 , wherein the plurality of raw byte data samples is deduplicated prior to use in training of the first neural network.
6 . The apparatus of claim 1 , wherein the RELU is used as a nonlinear activation function for learning a set of first and second convolutional layers of the first neural network.
7 . The apparatus of claim 1 , wherein the SELU is used as a nonlinear activation function for learning a set of fully connected layers of a feature-based classifier.
8 . A non-transitory computer readable medium comprising a plurality of instructions that, when executed, cause a machine to at least:
train a first neural network with a plurality of raw byte data samples, the plurality of raw byte data samples include both clean and malicious samples, the plurality of raw byte data samples are not preprocessed;
perform feature extraction using one or more raw byte data samples of the plurality of raw byte data samples and a rectified linear unit (RELU) to obtain extracted features, the extracted features including malware static features;
determine whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious using the extracted features; and
provide the malware static features as input to a second neural network to determine a family of malware to which an identified malicious sample belongs by using a scaled exponential linear unit (SELU).
9 . The non-transitory computer readable medium of claim 8 , wherein a feature-based classifier is used to determine whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious.
10 . The non-transitory computer readable medium of claim 8 , wherein a feature-based classifier is used to determine the family of malware to which the identified malicious sample belongs.
11 . The non-transitory computer readable medium of claim 8 , wherein the first neural network is trained using a supervised learning algorithm such as one or more of a Regression, Decision Tree, Random forest, k-nearest neighbors (KNN), or Logistic Regression algorithm.
12 . The non-transitory computer readable medium of claim 8 , wherein the plurality of raw byte data samples is deduplicated prior to use in training of the first neural network.
13 . The non-transitory computer readable medium of claim 8 , wherein the RELU is used as a nonlinear activation function for learning a set of first and second convolutional layers of the first neural network.
14 . A method to perform malware classification through convolutional neural networks using raw bytes, the method comprising:
training a first neural network with a plurality of raw byte data samples, the plurality of raw byte data samples include both clean and malicious samples, the plurality of raw byte data samples are not preprocessed;
performing feature extraction using one or more raw byte data samples of the plurality of raw byte data samples and a rectified linear unit (RELU) to obtain extracted features, the extracted features including malware static features;
determining whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious using the extracted features; and
providing the malware static features as input to a second neural network to determine a family of malware to which an identified malicious sample belongs by using a scaled exponential linear unit (SELU).
15 . The method of claim 14 , wherein a feature-based classifier is used to determine whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious.
16 . The method of claim 14 , wherein a feature-based classifier is used to determine the family of malware to which the identified malicious sample belongs.
17 . The method of claim 14 , wherein the first neural network is trained using a supervised learning algorithm such as one or more of a Regression, Decision Tree, Random forest, k-nearest neighbors (KNN), or Logistic Regression algorithm.
18 . The method of claim 14 , wherein the plurality of raw byte data samples is deduplicated prior to use in training of the first neural network.
19 . The method of claim 14 , wherein the RELU is used as a nonlinear activation function for learning a set of first and second convolutional layers of the first neural network.
20 . An apparatus to perform malware classification through convolutional neural networks using raw bytes comprising:
interface circuitry; and
processor circuitry including one or more of:
at least one of a central processing unit, a graphic processing unit or a digital signal processor, the at least one of the central processing unit, the graphic processing unit or the digital signal processor having control circuitry to control data movement within the processor circuitry, arithmetic and logic circuitry to perform one or more first operations according to instructions, and one or more registers to store a result of the one or more first operations, the instructions in the apparatus;
a Field Programmable Gate Array (FPGA), the FPGA including logic gate circuitry, a plurality of configurable interconnections, and storage circuitry, the logic gate circuitry and interconnections to perform one or more second operations, the storage circuitry to store a result of the one or more second operations; or
Application Specific Integrated Circuitry (ASIC) including logic gate circuitry to perform one or more third operations;
the processor circuitry to perform at least one of the one or more first operations, the one or more second operations or the one or more third operations to instantiate:
neural network training circuitry to train a first neural network with a plurality of raw byte data samples, the plurality of raw byte data samples include both clean and malicious samples, the plurality of raw byte data samples are not preprocessed;
feature extraction circuitry to perform feature extraction using one or more raw byte data samples of the plurality of raw byte data samples and a rectified linear unit (RELU) to obtain extracted features, the extracted features including malware static features;
sample classification circuitry to determine whether the one or more raw byte data samples of the plurality of raw byte data samples are clean or malicious using the extracted features; and
malware family classification circuitry to determine a family of malware to which an identified malicious sample belongs and by using the malware static features as input to a second neural network and a scaled exponential linear unit (SELU).
21 . The apparatus of claim 20 , wherein the RELU is used as a nonlinear activation function for learning a set of first and second convolutional layers of the first neural network.