Zero-day Malware Defence with Limited Samples  

作　　者：Yuanxiang Gong Chiya Zhang Yiyi Liu 

机构地区：[1]School of Electronic and Information Engineering,Harbin Institute of Technology,Shenzhen 518055,China [2]School of Management,Shenzhen Polytechnic University,Shenzhen 518055,China

出　　处：《Journal of Communications and Information Networks》2024年第4期340-347,共8页通信与信息网络学报(英文)

基　　金：supported by the National Natural Science Foundation of China under Grant U20A20156;supported by the Foundation of National Key Laboratory of Radar Signal Processing under Grant JKW202303.

摘　　要：Zero-day malware refers to a previously unknown or newly discovered type of malware.While most existing studies rely on large malware sample sets,their performance is unknown when dealing with a limited number of samples.This paper addresses this challenge by proposing a novel approach for effective zero-day malware detection,even with a scarcity of known samples.The proposed method begins by visualizing the malware binary and converting it into an entropy image.Subsequently,a deep convolutional generative adversarial network(DCGAN)is employed to learn from the available samples and generate new,highly similar synthetic samples.By combining these generated samples with the real ones,a comprehensive training set is constructed for a convolutional neural network(CNN)classification model.The randomness introduced by DCGAN facilitates the generation of new features,even in the presence of a small sample size.This enables the classifier to learn the characteristics of unknown zero-day malware and enhance its detection capabilities.Extensive experiments validate the effectiveness of the proposed approach,demonstrating that leveraging entropy images as features and applying DCGAN for data augmentation leads to a robust zero-day malware detection system,capable of achieving promising results even with a limited number of samples.

关 键 词：malware classification deep convolution generative adversarial network 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]