2020/12/16 by Edward Raff, William Fleshman, Raff, Edward +9 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Network Security and Intrusion Detection
paper · pdf · doi:10.48550/arxiv.2012.09390
openalex publication_date 2020/12/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Recent works within machine learning have been tackling inputs of\never-increasing size, with cybersecurity presenting sequence classification\nproblems of particularly extreme lengths. In the case of Windows executable\nmalware detection, inputs may exceed 100 MB, which corresponds to a time\nseries with T=100,000,000 steps. To date, the closest approach to handling\nsuch a task is MalConv, a convolutional neural network capable of processing up\nto T=2,000,000 steps. The \O(T) memory of CNNs has prevented\nfurther application of CNNs to malware. In this work, we develop a new approach\nto temporal max pooling that makes the required memory invariant to the\nsequence length T. This makes MalConv 116\× more memory efficient, and\nup to 25.8\× faster to train on its original dataset, while removing the\ninput length restrictions to MalConv. We re-invest these gains into improving\nthe MalConv architecture by developing a new Global Channel Gating design,\ngiving us an attention mechanism capable of learning feature interactions\nacross 100 million time steps in an efficient manner, a capability lacked by\nthe original MalConv CNN. Our implementation can be found at\nhttps://github.com/NeuromorphicComputationResearchProgram/MalConv2\n