Yue Zhang, Hyun-HoYang, Ning Gao, Journal of Internet Computing and Services, Vol. 21, No. 5, pp. 57-65, Oct. 2020
10.7472/jksii.2020.21.5.57, Full Text:  HTML
Keywords: Malicious Executable Detection, Transfer Learning, Feature-Based

Abstract

At present, the existing virus recognition systems usually use signature approach to detect malicious executable files, but these methods often fail to detect new and invisible malware. At the same time, some methods try to use more general features to detect malware, and achieve some success. Moreover, machine learning-based approaches are applied to detect malware, which depend on features extracted from malicious codes. However, the different distribution of features oftraining and testing datasets also impacts the effectiveness of the detection models. And the generation oflabeled datasets need to spend a significant amount time, which degrades the performance of the learning method. In this paper, we use transfer learning to detect new and previously unseen malware. We first extract the features of Portable Executable (PE) files, then combine transfer learning training model with KNN approachto detect the new and unseen malware. We also evaluate the detection performance of a classifier in terms of precision, recall, F1, and so on. The experimental results demonstrate that proposed method with high detection rates andcan be anticipated to carry out as well in the real-world environment.

Statistics
Cite this article