Learning the PE Header, Malware Detection with Minimal Domain Knowledge

Code

• github.com/jaketae/pytorch-malware-detection
  pytorch★ 81
• github.com/jaketae/deep-malware-detection
  pytorch★ 0

Abstract

Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge, namely byte n-grams and strings. In this work we explore the feasibility of applying neural networks to malware detection and feature learning. We do this by restricting ourselves to a minimal amount of domain knowledge in order to extract a portion of the Portable Executable (PE) header. By doing this we show that neural networks can learn from raw bytes without explicit feature construction, and perform even better than a domain knowledge approach that parses the PE header into explicit features.

Tasks

Reproductions