Explainable Malware Detection System Using Transformers-Based Transfer Learning and Multi-Model Visual Representation

Farhan Ullah

doi:10.3390/s22186766

Return

Explainable Malware Detection System Using Transformers-Based Transfer Learning and Multi-Model Visual Representation

2022-09-07

Farhan Ullah *

Amjad Alsirhani

Mohammed Mujib Alshahrani

Abdullah Alomari

Hamad Naeem

Syed Aziz Shah

DOI：10.3390/s22186766

Original

Save

View PDF

Abstract

En 中文

Android has become the leading mobile ecosystem because of its accessibility and adaptability. It has also become the primary target of widespread malicious apps. This situation needs the immediate implementation of an effective malware detection system. In this study, an explainable malware detection system was proposed using transfer learning and malware visual features. For effective malware detection, our technique leverages both textual and visual features. First, a pre-trained model called the Bidirectional Encoder Representations from Transformers (BERT) model was designed to extract the trained textual features. Second, the malware-to-image conversion algorithm was proposed to transform the network byte streams into a visual representation. In addition, the FAST (Features from Accelerated Segment Test) extractor and BRIEF (Binary Robust Independent Elementary Features) descriptor were used to efficiently extract and mark important features. Third, the trained and texture features were combined and balanced using the Synthetic Minority Over-Sampling (SMOTE) method; then, the CNN network was used to mine the deep features. The balanced features were then input into the ensemble model for efficient malware classification and detection. The proposed method was analyzed extensively using two public datasets, CICMalDroid 2020 and CIC-InvesAndMal2019. To explain and validate the proposed methodology, an interpretable artificial intelligence (AI) experiment was conducted.

Keywords:

malware analysis

transfer learning

malware visualization

explainable AI

cybersecurity

malicious

network behavior

AI Summary

Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.