[Paper Review] Deep Learning Models for Detecting Malware Attacks

Pascal Maniriho, Abdun Naser Mahmood+1 more|arXiv (Cornell University)|Sep 8, 2022

Advanced Malware Detection Techniques4 citations

TL;DR

This paper provides a comprehensive review of deep learning (DL) models for detecting malware on Windows, Linux, and Android platforms, emphasizing DL's ability to automate feature extraction and handle large-scale malware datasets. It evaluates key DL components—architectures, optimizers, loss functions, activation functions, regularization, and frameworks—while identifying critical challenges such as adversarial attacks, computational cost, and limited Linux malware detection research, proposing future directions for robust, real-time, and lightweight models.

ABSTRACT

Malware is one of the most common and severe cyber-attack today. Malware infects millions of devices and can perform several malicious activities including mining sensitive data, encrypting data, crippling system performance, and many more. Hence, malware detection is crucial to protect our computers and mobile devices from malware attacks. Deep learning (DL) is one of the emerging and promising technologies for detecting malware. The recent high production of malware variants against desktop and mobile platforms makes DL algorithms powerful approaches for building scalable and advanced malware detection models as they can handle big datasets. This work explores current deep learning technologies for detecting malware attacks on the Windows, Linux, and Android platforms. Specifically, we present different categories of DL algorithms, network optimizers, and regularization methods. Different loss functions, activation functions, and frameworks for implementing DL models are presented. We also present feature extraction approaches and a review of recent DL-based models for detecting malware attacks on the above platforms. Furthermore, this work presents major research issues on malware detection including future directions to further advance knowledge and research in this field.

Motivation & Objective

• To provide a systematic review of deep learning technologies for malware detection across Windows, Linux, and Android platforms.
• To identify and analyze key deep learning components such as network optimizers, loss functions, activation functions, and regularization techniques.
• To examine feature extraction methods and recent DL-based malware detection models for desktop and mobile platforms.
• To highlight critical research gaps, including adversarial attacks, computational cost, and limited focus on Linux malware detection.
• To propose future research directions for developing robust, real-time, and lightweight DL-based malware detection systems.

Proposed method

• Surveying and categorizing deep learning algorithms, including CNNs, RNNs, and autoencoders, used in malware detection.
• Analyzing network optimizers (e.g., Adam, RMSProp), loss functions (e.g., binary cross-entropy), and activation functions (e.g., ReLU, Leaky ReLU).
• Evaluating regularization techniques such as dropout and batch normalization to prevent overfitting in DL models.
• Reviewing frameworks like TensorFlow and PyTorch for implementing DL-based malware detection systems.
• Assessing feature extraction approaches, including binary image representation, API call sequences, and permission-based features.
• Examining parallelization strategies (data and model parallelization) to reduce training time and improve scalability.

Experimental results

Research questions

• RQ1 What are the most effective deep learning architectures and components for detecting malware on Windows, Linux, and Android platforms?
• RQ2 How do different loss functions, activation functions, and regularization methods impact the performance of DL-based malware detection models?
• RQ3 What are the major challenges in deploying DL-based malware detection systems, particularly regarding adversarial attacks and computational cost?
• RQ4 Why is there a research gap in deep learning-based malware detection for Linux systems, and what are the implications?
• RQ5 How can future DL models be designed to be more robust, lightweight, and suitable for real-time deployment on mobile and edge devices?

Key findings

• Deep learning models outperform traditional machine learning methods by enabling automatic feature extraction and handling large-scale malware datasets effectively.
• Adversarial attacks remain a significant threat, as minor perturbations to malware binaries can evade detection by fooling DL models.
• Only a small fraction of existing research focuses on Linux-based malware detection, despite a 35% increase in Linux malware attacks and rising threats like XorDdos.
• Model and data parallelization techniques are essential for reducing training time and enabling scalable deployment of DL-based malware detection systems.
• Current DL-based malware detection models often suffer from high computational costs and lack real-time efficiency, especially on mobile devices.
• The integration of lightweight and robust architectures is critical for future deployment on resource-constrained platforms like Android and embedded systems.