Malware Classification Using Long Short-Term Memory Models

2021/03/03 by Dennis Dang, Dang, Dennis, Fabio Di Troia +3
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.2103.02746

openalex publication_date 2021/03/03 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Signature and anomaly based techniques are the quintessential approaches to malware detection. However, these techniques have become increasingly ineffective as malware has become more sophisticated and complex. Researchers have therefore turned to deep learning to construct better performing model. In this paper, we create four different long-short term memory (LSTM) based models and train each to classify malware samples from 20 families. Our features consist of opcodes extracted from malware executables. We employ techniques used in natural language processing (NLP), including word embedding and bidirection LSTMs (biLSTM), and we also use convolutional neural networks (CNN). We find that a model consisting of word embedding, biLSTMs, and CNN layers performs best in our malware classification experiments.

Citations

• Deep Bidirectional and Unidirectional LSTM Recurrent Neural Network for Network-wide Traffic Speed Prediction
• Malware Detection with LSTM using Opcode Language

Related

• An Empirical Analysis of Image-Based Learning Techniques for Malware Classification
• Robust Neural Malware Detection Models for Emulation Sequence Learning
• Malware Classification using Deep Learning based Feature Extraction and Wrapper based Feature Selection Technique
• Malware Classification from Memory Dumps Using Machine Learning, Transformers, and Large Language Models
• OpCode-Based Malware Classification Using Machine Learning and Deep Learning Techniques