Deep Learning Fusion For Effective Malware Detection: Leveraging Visual Features

TL;DR

This paper introduces a novel multimodal deep learning fusion approach using visual features for malware detection, achieving perfect accuracy and real-time classification even on obfuscated malware.

Contribution

It proposes a new multimodal fusion algorithm combining three visual malware features and demonstrates its effectiveness and interpretability for malware detection.

Findings

Detection rate of 1.00 on the dataset

Effective on highly imbalanced and obfuscated malware

Real-time detection with VGG16 model

Abstract

Malware has become a formidable threat as it has been growing exponentially in number and sophistication, thus, it is imperative to have a solution that is easy to implement, reliable, and effective. While recent research has introduced deep learning multi-feature fusion algorithms, they lack a proper explanation. In this work, we investigate the power of fusing Convolutional Neural Network models trained on different modalities of a malware executable. We are proposing a novel multimodal fusion algorithm, leveraging three different visual malware features: Grayscale Image, Entropy Graph, and SimHash Image, with which we conducted exhaustive experiments independently on each feature and combinations of all three of them using fusion operators such as average, maximum, add, and concatenate for effective malware detection and classification. The proposed strategy has a detection rate of 1.00 (on a scale of 0-1) in identifying malware in the given dataset. We explained its interpretability with visualization techniques such as t-SNE and Grad-CAM. Experimental results show the model works even for a highly imbalanced dataset. We also assessed the effectiveness of the proposed method on obfuscated malware and achieved state-of-the-art results. The proposed methodology is more reliable as our findings prove VGG16 model can detect and classify malware in a matter of seconds in real-time.