Malware classification of executable files by convolutional networks
A convolutional deep neural network architecture can detect malicious executable files by reading the raw sequence of bytes, that is, without any domain-specific feature extraction or preprocessing.
1. A method comprising:
receiving an executable file, wherein the executable file is comprised of one or more bytes;
embedding the executable file by converting each of the bytes in the executable file to vectors;
determining whether the executable file includes malware by passing the vectors through a convolutional neural network (CNN), wherein the CNN includes a plurality of convolutional layers and a global average pooling layer, and wherein the CNN further includes a max pooling layer and a plurality of fully connected layers, and wherein the plurality of convolutional layers includes a first set of convolutional layers and a second set of convolutional layers, and wherein said passing the vectors through the CNN comprises:
passing the vectors to an input of the first set of convolutional layers;
passing an output of the first set of convolutional layers to an input of the max pooling layer;
passing an output of the max pooling layer to an input of the second set of convolutional layers;
passing an output of the second set of convolutional layers to an input of the global average pooling layer; and
passing an output of the global average pooling layer to an input of the fully connected layers; and
providing an output indicating the determination of whether the received executable file includes the malware.
2. The method of claim 1 , wherein each of the bytes is an eight-dimensional vector.
3. The method of claim 1 , further comprising projecting, by the global average pooling layer, the output of the second set of convolutional layers to a fixed size representation.
4. The method of claim 1 , further comprising:
shifting a first convolutional kernel between adjacent convolutional layers of the first set of convolutional layers by four elements of the vector; and
shifting a second convolutional kernel between adjacent convolutional layers of the second set of convolutional layers by eight elements of the vector.
5. The method of claim 1 , further comprising:
denying execution of the executable file in response to determining the executable file includes the malware; and
executing the executable file in response to determining the executable file does not include the malware.
6. A system comprising:
at least one processor; and
a non-transitory computer readable storage medium having a program stored thereon, the program causing the at least one processor to execute the steps of:
receiving an executable file, wherein the executable file is comprised of one or more bytes;
embedding the executable file by converting each of the bytes in the executable file to vectors;
determining whether the executable file includes malware by passing the vectors through a convolutional neural network (CNN), wherein the CNN includes a plurality of convolutional layers and a global average pooling layer, wherein the CNN further include a max pooling layer and a plurality of fully connected layers, and wherein the plurality of convolutional layers includes a first set of convolutional layers and a second set of convolutional layers, and wherein said passing the vectors through the CNN comprises:
passing the vectors to an input of the first set of convolutional layers;
passing an output of the first set of convolutional layers to an input of the max pooling layer;
passing an output of the max pooling layer to an input of the second set of convolutional layers;
passing an output of the second set of convolutional layers to an input of the global average pooling layer; and
passing an output of the global average pooling layer to an input of the fully connected layers; and
providing an output indicating the determination of whether the received executable file includes the malware.
7. The system of claim 6 , wherein each of the bytes is an eight-dimensional vector.
8. The system of claim 6 , further comprising projecting, by the global average pooling layer, the output of the second set of convolutional layers to a fixed size representation.
9. The system of claim 6 , further comprising:
shifting a first convolutional kernel between adjacent convolutional layers of the first set of convolutional layers by four elements of the vector; and
shifting a second convolutional kernel between adjacent convolutional layers of the second set of convolutional layers by eight elements of the vector.
10. The system of claim 6 , further comprising:
denying execution of the executable file in response to determining the executable file includes the malware; and
executing the executable file in response to determining the executable file does not include the malware.
11. A non-transitory computer readable storage medium comprising a set of instructions executable by a computer, the non-transitory computer readable storage medium comprising:
instructions for receiving an executable file, wherein the executable file is comprised of one or more bytes;
instructions for embedding the executable file by converting each of the bytes in the executable file to vectors;
instructions for determining whether the executable file includes malware by passing the vectors through a convolutional neural network (CNN), wherein the CNN includes a plurality of convolutional layers and a global average pooling layer, and wherein the CNN further includes a max pooling layer and a plurality of fully connected layers, and wherein the plurality of convolutional layers includes a first set of convolutional layers and a second set of convolutional layers, and wherein the instructions for passing the vectors through the CNN comprise:
instructions for passing the vectors to an input of the first set of convolutional layers;
instructions for passing an output of the first set of convolutional layers to an input of the max pooling layer;
instructions for passing an output of the max pooling layer to an input of the second set of convolutional layers;
instructions for passing an output of the second set of convolutional layers to an input of the global average pooling layer; and
instructions for passing an output of the global average pooling layer to an input of the fully connected layers; and
instructions for providing an output indicating the determination of whether the received executable file includes the malware.
12. The non-transitory computer readable storage medium of claim 11 , further comprising instructions for projecting, by the global average pooling layer, the output of the second set of convolutional layers to a fixed size representation.
13. The non-transitory computer readable storage medium of claim 11 , further comprising:
instructions for shifting a first convolutional kernel between adjacent convolutional layers of the first set of convolutional layers by four elements of the vector; and
instructions for shifting a second convolutional kernel between adjacent convolutional layers of the second set of convolutional layers by eight elements of the vector.
14. The non-transitory computer readable storage medium of claim 11 , further comprising:
instructions for denying execution of the executable file in response to determining the executable file includes the malware; and
instructions for executing the executable file in response to determining the executable file does not include the malware.
15. A method comprising:
receiving, at one or more computing devices, an executable file, wherein the executable file is comprised of one or more bytes;
embedding the executable file by converting each of the bytes in the executable file to vectors;
determining whether the received executable file includes malware by passing the vectors through a convolutional neural network (CNN), wherein the CNN includes a plurality of convolutional layers and a global average pooling layer; and wherein the CNN further includes a max pooling layer and a plurality of fully connected layers, and wherein the plurality of convolutional layers includes a first set of convolutional layers and a second set of convolutional layers, and wherein said passing the vectors through the CNN comprises:
passing the vectors to an input of the first set of convolutional layers;
passing an output of the first set of convolutional layers to an input of the max pooling layer;
passing an output of the max pooling layer to an input of the second set of convolutional layers;
passing an output of the second set of convolutional layers to an input of the global average pooling layer; and
passing an output of the global average pooling layer to an input of the fully connected layers; and
providing an output indicating whether the received executable file includes the malware.
16. The method of claim 15 , wherein the determining comprises determining, using an executable file classification engine stored in one or more memory devices of the one or more computing devices, whether the received executable file includes the malware, the executable file classification engine being trained, using supervised learning, to classify the executable file into at least one of a plurality of classes.
17. The method of claim 15 , wherein the determining comprises determining, based on a feature vector comprising a plurality of features extracted from at least a portion of the received executable file.