用多模态方法分析PE文件各部分，提升恶意软件分类准确率。
Multimodal Techniques for Malware Classification
- 分模块提取PE文件头和各段特征，分别训练SVM、LSTM、CNN模型。
- 融合多个模型输出概率作为新特征，使分类准确率显著提升。
- 适合安全研究者与恶意软件检测系统开发者参考。
恶意软件威胁严重，亟需高效分类技术。本研究基于Windows可移植可执行文件（PE）的结构特性，探索多模态机器学习方法用于恶意软件分类。具体而言，我们对PE文件头特征、其他部分特征以及完整文件特征分别训练支持向量机（SVM）、长短期记忆网络（LSTM）和卷积神经网络（CNN）模型。随后，将上述基线模型的输出层概率作为特征向量，训练SVM模型以处理九种头-段组合。实验表明，最优的多模态模型性能优于任一基线模型，证明在不同部分上独立建模具有优势。
原文摘要 · Abstract (English)
The threat of malware is a serious concern for computer networks and systems, highlighting the need for accurate classification techniques. In this research, we experiment with multimodal machine learning approaches for malware classification, based on the structured nature of the Windows Portable Executable (PE) file format. Specifically, we train Support Vector Machine (SVM), Long Short-Term Memory (LSTM), and Convolutional Neural Network (CNN) models on features extracted from PE headers, we train these same models on features extracted from the other sections of PE files, and train each model on features extracted from the entire PE file. We then train SVM models on each of the nine header-sections combinations of these baseline models, using the output layer probabilities of the component models as feature vectors. We compare the baseline cases to these multimodal combinations. In our experiments, we find that the best of the multimodal models outperforms the best of the baseline cases, indicating that it can be advantageous to train separate models on distinct parts of Windows PE files.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。