论文标题
MALDETCONV：基于自然语言处理和深度学习技术的基于自动行为的恶意软件检测框架
MalDetConv: Automated Behaviour-based Malware Detection Framework Based on Natural Language Processing and Deep Learning Techniques
论文作者
论文摘要
Windows的受欢迎程度吸引了黑客/网络攻击者的注意，使Windows设备成为近年来恶意软件攻击的主要目标。几种复杂的恶意软件变体和反检测方法已得到显着增强，因此，传统的恶意软件检测技术变得效率较低。这项工作介绍了使用动态分析方法从良性和恶意软件可执行文件中提取的Windows Application编程接口（API）调用的新行为数据集Malbehavd-V1。此外，我们提出了MALDETCONV，这是一种基于自动化行为的新框架，用于检测现有和零日恶意软件攻击。 MaldetConv使用基于文本处理的编码器将API调用的功能转换为由深度学习模型支持的合适格式。然后，它使用卷积神经网络（CNN）和双向门控复发单元（CNN-BIGRU）自动提取器的混合体选择API调用的高级特征，然后将其馈送到完全连接的神经网络模块中以进行恶意软件分类。 MaldetConv还使用了可解释的组件，该组件揭示了有助于最终分类结果的功能，从而帮助安全分析师的决策过程。使用我们的MALBEHAVD-V1数据集和其他基准数据集评估了建议的框架的性能。检测结果证明了MaldetConv对最先进技术的有效性，检测准确性为96.10％，95.73％，98.18％和99.93％的效果，分别从Malbehavd-V1，Allan和John，Brazilian和Ki-d数据集中检测到了看不见的恶意软件。实验结果表明，MALDETCONV在检测Windows设备上的已知和零日恶意软件攻击方面非常准确。
The popularity of Windows attracts the attention of hackers/cyber-attackers, making Windows devices the primary target of malware attacks in recent years. Several sophisticated malware variants and anti-detection methods have been significantly enhanced and as a result, traditional malware detection techniques have become less effective. This work presents MalBehavD-V1, a new behavioural dataset of Windows Application Programming Interface (API) calls extracted from benign and malware executable files using the dynamic analysis approach. In addition, we present MalDetConV, a new automated behaviour-based framework for detecting both existing and zero-day malware attacks. MalDetConv uses a text processing-based encoder to transform features of API calls into a suitable format supported by deep learning models. It then uses a hybrid of convolutional neural network (CNN) and bidirectional gated recurrent unit (CNN-BiGRU) automatic feature extractor to select high-level features of the API Calls which are then fed to a fully connected neural network module for malware classification. MalDetConv also uses an explainable component that reveals features that contributed to the final classification outcome, helping the decision-making process for security analysts. The performance of the proposed framework is evaluated using our MalBehavD-V1 dataset and other benchmark datasets. The detection results demonstrate the effectiveness of MalDetConv over the state-of-the-art techniques with detection accuracy of 96.10%, 95.73%, 98.18%, and 99.93% achieved while detecting unseen malware from MalBehavD-V1, Allan and John, Brazilian, and Ki-D datasets, respectively. The experimental results show that MalDetConv is highly accurate in detecting both known and zero-day malware attacks on Windows devices.
