用混合模型提升恶意软件分类准确率
Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network
- 结合隐马尔可夫模型与卷积神经网络提取指令序列特征
- 在Malicia数据集上优于已有HMM-随机森林模型
- 适合关注恶意软件检测的网络安全研究者
恶意软件变种的泛滥对传统基于签名的检测方法构成严峻挑战，亟需先进的机器学习技术。本文提出一种新型混合架构：先用隐马尔可夫模型（HMM）提取操作码序列中的时序模式特征，再通过卷积神经网络（CNN）捕捉层次化特征，实现恶意软件分类。该方法受先前HMM-随机森林模型优异表现的启发，旨在融合二者优势。实验在主流的Malicia数据集上进行，结果表明，该混合模型性能优于多种现有机器学习方法，显著超越此前的HMM-随机森林模型。研究证实了混合HMM-CNN架构在提升恶意软件分类能力方面的潜力，为网络安全领域提供了多个值得深入探索的方向。
原文摘要 · Abstract (English)
The proliferation of malware variants poses a significant challenges to traditional malware detection approaches, such as signature-based methods, necessitating the development of advanced machine learning techniques. In this research, we present a novel approach based on a hybrid architecture combining features extracted using a Hidden Markov Model (HMM), with a Convolutional Neural Network (CNN) then used for malware classification. Inspired by the strong results in previous work using an HMM-Random Forest model, we propose integrating HMMs, which serve to capture sequential patterns in opcode sequences, with CNNs, which are adept at extracting hierarchical features. We demonstrate the effectiveness of our approach on the popular Malicia dataset, and we obtain superior performance, as compared to other machine learning methods -- our results surpass the aforementioned HMM-Random Forest model. Our findings underscore the potential of hybrid HMM-CNN architectures in bolstering malware classification capabilities, offering several promising avenues for further research in the field of cybersecurity.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。