The Application Of Convolution Network In PE Malware Detection

The success of deep learning technology in the image field has attracted the attention of network security researchers.Researchers hope to empower the security industry with neural networks.PE file is an executable file format of Windows system.Malware detection for this type of file is an important area of network security.As some malicious malware are derived from former ones,there exists similarities between malicious samples,which makes it possible to build an end-to-end deep learning malware detection model.Compared with other applications,malware detection is a highly adversarial scenario,so the robustness of the model should be focused on.Meanwhile,the interpretability and detection efficiency of the model also need to be considered.This thesis started research in view of the issues above,and the main contributions are as follows:(1)Aiming at the problem of balancing malware detection efficiency and detection accuracy,this thesis proposes a lightweight one-dimensional convolutional neural network malware detection model.First of all,depthwise separable convolution is used as the basic unit of the detection model to improve the detection efficiency on the CPU.The word embedding layer is used to solve the discreteness of malware bytes,and dilated convolution and modular residual structure are introduced to ensure the detection accuracy of the model.The accuracy rate can reach 99.05% on the Malimg dataset.Compared with the existing end-to-end deep learning detection methods,the inference time using CPU is shorter.(2)To figure out the interpretability of the deep learning malware detection model,this thesis uses the method of mapping the saliency map back to the PE structure for analysis.Grad-CAM and gradient-based saliency map algorithm are applied to obtain the saliency map intervals of the convolutional network model for malware and benign software.These intervals are then mapped to certain part of PE structure.By analyzing the Statistics results,the decision preferences of the trained convolutional network model for PE file is figured out.(3)This thesis proposes a gradient-based adversarial sample generation method for malware detection.Based on this,combined with traditional obfuscation encryption attacks,the robustness of the model is analyzed.Without changing the function of the malware,a discrete gradient adversarial attack algorithm based on redundant space of the malware is proposed to generate adversarial samples for malware detection.The robustness of the model is then analyzed respectively in white box and black box scenarios.Packed malware are generated by UPX packer,and then randomizing mechanism are applied on specific part of these packed malware to analyze the robustness of the model towards packing attack.The experimental result shows that the deep convolutional neural network structure proposed in this thesis has better resistance to adversarial samples based on gradient optimization than existing models.However,due to the characteristics of static malware detection,it cannot deal with packed software well.