An early malware threat detection model using Conditional Tabular Generative Adversarial Network

In this paper, we propose the use of CT-GAN, a novel conditional table GAN architecture, to address the challenges of limited data availability in the field of malware detection. The current state-of-the-art data synthesizers for tabular data focus on continuous and categorical variables separately, while our approach combines both types of variables in a unified framework.To evaluate our method, we employed the KDD_cup99 dataset provided by the University of New Brunswick and used CT-GAN to generate a similar dataset. We trained the CT-GAN model using the generated dataset and assessed its performance by testing it on the original dataset. Surprisingly, our evaluation revealed consistently high accuracies exceeding 93% across various models, including basic machine learning algorithms, when trained on the CT-GAN generated dataset. By employing different train-test splits, we determined that a split of 67-33 yielded the best results. The generated data closely resembled the original data but exhibited a good partition between different classes, which facilitated more effective training of the models. We experimented with several classifier models, such as Gaussian-NB, decision tree classifier, and random forest, to train the GAN-generated dataset. The accuracy of these different models is also presented in the paper.GANs are particularly advantageous in their ability to generate novel data samples through an adversarial training process involving a generator and discriminator. Our CT-GAN approach leverages this capability to overcome the limitations posed by limited data availability in the domain of malware detection.