Malware detection via memory dump images: investigating the role of uneven kernel filters in CNNs with visual explainability
TL;DR
This paper proposes a novel CNN architecture with uneven kernel sizes that outperforms existing malware detection and classification models and compares its performance against well-known CNN architectures, all trained and tested on malware image datasets.
Abstract
With the Internet becoming more accessible, protecting our digital identities has become more crucial than ever. Our devices are always online, sharing data, and exposed to numerous threats. Traditional methods of detecting malware are no longer adequate due to the rapid advancement and complexity of malware. To address these challenges, researchers have started using artificial intelligence, especially machine learning and deep learning techniques, with encouraging outcomes. One emerging approach involves converting malware binaries or memory dumps into images. However, these malware images are not recognizable to the human eye and, therefore, need to be explained in terms of how the CNNs perceive this data type. This paper applies the Grad-CAM technique to malware images collected from memory dumps to understand sufficiently how black-box CNN models make predictions with this data. Based on insights from the Grad-CAM analysis, we propose a novel CNN architecture with uneven kernel sizes that outperforms existing malware detection and classification models. We compare its performance against well-known CNN architectures, all trained and tested on malware image datasets such as Malimg, Dumpware10, MaleVis, and MalBen. Our proposed architecture achieved an impressive accuracy of 99.58% on the Malimg dataset with fewer training parameters, surpassing previous models, which achieved a maximum accuracy of 99.26% on the same dataset.