Journals
  Publication Years
  Keywords
Search within results Open Search
Please wait a minute...
For Selected: Toggle Thumbnails
Portable executable malware static detection model based on shallow artificial neural network
Tianchen HUA, Xiaoning MA, Hui ZHI
Journal of Computer Applications    2025, 45 (6): 1911-1921.   DOI: 10.11772/j.issn.1001-9081.2024060857
Abstract15)   HTML0)    PDF (3218KB)(1)       Save

In order to address the imbalance or incompleteness issues of the datasets in Portable Executable (PE) malware detection methods based on deep learning, as well as the problem of increase of model computing resource overhead and time-consuming caused by too deep neural network structure or large feature sets, a PE malware static detection model based on Shallow Artificial Neural Network (SANN) was proposed. Firstly, LIEF(Library to Instrument Executable Formats) library was used to create a PE feature extractor to extract PE file samples from EMBER dataset, and a feature combination was proposed. In this feature set, there were fewer PE features, thereby reducing the feature space and parameters while improving performance of the deep learning model. Secondly, after generating feature vectors, the unlabeled samples were removed through data cleaning. Thirdly, different feature values in the feature set were normalized. Finally, the feature vectors were input into SANN for training and testing. Experimental results show that SANN can achieve a recall of 95.64% and an accuracy of 95.24%. Compared to the MalConv model and LightGBM model, the accuracy of SANN has increased by 1.19 and 1.57 percentage points, respectively. The total working time of SANN is about half of the comparison model LightGBM that takes the least time. Besides, facing unknown attacks, SANN is flexible and can still maintain a high level of detection.

Table and Figures | Reference | Related Articles | Metrics