TuningMalconv: Malware Detection With Not Just Raw Bytes

Malware is one of the main security threats in this digital world. Traditional security solutions can not keep space with the emerging malwares. Currently, machine learning has bear fruit in many areas and its application in security receives more and more attention. Many different features can be used as input features, such as opcodes and byte entropy. Raw bytes of binaries can also act as the inputs of machine learning without any domain knowledge. However, the input size of raw bytes is confined. And when the binary sizes differ greatly, pure raw bytes may lack the key information to make right decisions. In this paper, we implement a detection model called TuningMalconv, which uses richer features to detect malwares. TuningMalconv is made up of two layers and the two layers are independent models. Raw bytes are the input features of the first layer. If the first layer lacks the confidence to make decisions. The second layer extracts n-grams of byte codes, PE imports, string patterns in binaries, and PE section names from the binaries. And then the second layer takes these features as inputs to make the final decisions. We use two datasets to evaluate our model, a small one and a large one. The experiment results show that TuningMalconv can achieve robust performance. It takes about 1100 seconds to detect 8213 softwares, which is practical. And the overall accuracy of TuningMalconv can reach 99.03% on our small dataset and 98.69% on the large dataset. Thus TuningMalconv can perform efficient and effective malware detection with extended features beyond raw bytes.