Intelligent Malware Detection Using Sentence Transformer and Hybrid Deep Learning Architecture

The complex evasion techniques adopted by the malware creator make signature-based malware detection approaches unable to detect unknown malware attacks. This study proposes a new malware detection and classification approach with significantly less dependence on manual feature engineering. The bidirectional encoder representations from transformers (BERT) are used to model the opcode sequences of the malware file as the semantic behavior of malware. After that, the vectorized feature vector is fed to the hybrid one-dimensional convolution neural network (1D-CNN) and the gated recurrent unit (GRU) model for feature reduction and normalization before training a Softmax classifier. A hybrid learning architecture is designed with a custom 1D-CNN and a GRU model to take the strengths of both types of networks. The proposed scheme is evaluated using the Microsoft BIG dataset, consisting of 1625 assembly files belonging to 9 distinct malware families. The proposed method produced 95.77% accuracy even with the smaller dataset, which we believe will boost performance by adding a more diverse dataset. It uses the next-generation BERT language model, which gives a promising future area for malware defenders. This research presents malware detection without much reliance on manual feature engineering or signature-based detection, making it suitable for detecting unknown malware attacks.