Malware has become a serious threat to the internet. According to antivirus company McAfee, an average of 588 malware attacks occurs every minute. The LockBit ransomware infected Indonesia National Data Center and caused the downtime of 282 Indonesian government institutions’ services for more than a week. Malware also caused economic losses. During 2023, it was reported that $1.1 trillion in ransomware payments were made.
To detect malware, antivirus still relies on signature-based and heuristic-based detection techniques. This technique is effective for detecting malware. However, malware signatures and heuristic rules are compiled by malware analysts manually. It takes time and special skills to detect malware and create a signature. With the growing number of malwares, an automatic malware detection process is required. For this reason, machine learning technology is implemented for malware detection. With machine learning, the malware detection process is carried out automatically. However, the implementation of machine learning on malware detection still faces several problems. First the dataset labeling process takes a significant amount of time. Second, machine learning is not yet capable of detecting new malware. This highlights the need for a new malware detection method.
In this study, a new malware detection method using machine learning is proposed to address these problems. The approach involves developing new detection techniques based on self-supervised learning methods and a multimodal architecture. Self-supervised learning techniques, which have been successfully applied in computer vision, achieve competitive results with supervised learning techniques but do not require an extensive labeling process.
A novel malware detection method based on self-supervised has been developed, eliminating the need for a large labeling process. New malware was detected using multimodal methods. Malware files were converted into images, and their patterns were analyzed. Assuming that new malware reused code from known malware, the multimodal identified new malware by recognizing patterns from previously identified malware. The multimodal architecture combines two malware detection methods: one using image representations and the other using audio representations.
The development of the proposed malware detection method is divided into three stages. The first stage involves developing a malware detection method using an image-based representation method with self-supervised learning (SSL). The second stage focuses on the development of a malware detection method utilizing audio representation with convolutional neural network (CNN). Finally, the third stage involves the development of multimodal architecture. The methods for all three stages are conducted using an experimental approach.
The novelty of this research lies in the development of MalSSL, a malware detection method that does not require an extensive labeling process and multimodal approach to recognize new malware. MalSSL, the proposed method based on self-supervised learning and image representation, achieves malware classification accuracy of 98.4% without the need for labeling. The multimodal architecture, which combines image and audio representations using a late fusion approach, can detect new malware variants with an accuracy of 95.1%. Additionally, it achieves an accuracy of 99.7% in classifying known malware.
Paper:
https://ieeexplore.ieee.org/document/10506513
code: