2021/03/07 by Aniket Chandak, Wendy Lee, Chandak, Aniket +3
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Cybercrime and Law Enforcement Studies #FOS: Computer and information sciences #Machine Learning (cs.LG) #Spam and Phishing Detection #cs.CR #cs.LG
paper · pdf · doi:10.48550/arxiv.2103.05763
arxiv created 2021/03/07 · openalex publication_date 2021/03/07 · arxiv updated 2021/03/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Word embeddings are often used in natural language processing as a means to quantify relationships between words. More generally, these same word embedding techniques can be used to quantify relationships between features. In this paper, we first consider multiple different word embedding techniques within the context of malware classification. We use hidden Markov models to obtain embedding vectors in an approach that we refer to as HMM2Vec, and we generate vector embeddings based on principal component analysis. We also consider the popular neural network based word embedding technique known as Word2Vec. In each case, we derive feature embeddings based on opcode sequences for malware samples from a variety of different families. We show that we can obtain better classification accuracy based on these feature embeddings, as compared to HMM experiments that directly use the opcode sequences, and serve to establish a baseline. These results show that word embeddings can be a useful feature engineering step in the field of malware analysis.