Hybrid Gce Cnn–Bilstm For Advanced Malware Detection Using Behavioral And Sequential Features

Abstract

The study introduces an innovative approach of deep learning-based hybrid system to classify malware  based on its real-time detection using a novel architecture called “Gated Convolutional Embedded Convolutional Network - Bidirectional Long Short-Term Memory (GCE-CNN-BiLSTM)” that integrates both static and dynamic sequences of malware (malware)..This system combines two data types for use with malware detection: the first is static characteristics (opcode) and n-grams of the static data (extracted from Portable Executable - PE - files) while the second is log data dynamically created in an environment where the malware was run (i.e., using the Cuckoo Sandbox). The log files contain information on dynamic activities performed by an executable file during execution (such as API calls, changing the registry, performing file system activity) and the static characteristics of the executable binary itself. The proposed system uses a one-dimensional (1D) CNN for localized, binary opcodes to create input sequences containing embedded opcode sequences which will be used by the LSTM to perform binary classification of malware execution; furthermore, a Bidirectional LSTM will be used to capture long-term (temporal) dependencies associated with executable files executed in the malware (opcode) execution flow and execution behaviour. The output from both channels (CNN and Bidirectional LSTM) will be combined and fused together for robustness purposes against obfuscated executables, packed executables, and polymorphic executables. The performance metrics were evaluated using a total of 10,000 labelled malware data samples from the Malimg datasets and 7,500 labelled executable behaviours generated by Cuckoo Sandbox. The accuracy for GCE-CNN-BiLSTM using these datasets was found to be at 98.3% accuracy, 97.8% precision, and 98.1% recall, demonstrating the efficacy of using a hybrid approach for advanced malware detection.