Deep Learning for Malware Classification Platform using Windows API Call Sequence

Abstract

Malware attacks and the growth of new types of malwares are things for government and industry departments to consider. More and more types of malware attacks require preventative measures using deep learning for malware analysis to minimize the impact of malware attacks. In this case, the task of the cyber-attack detection team of the National Cybersecurity and Encryption Agency Threat Detection Agency is to perform malware analysis. This research implemented malware detection and classification using a deep learning model by leveraging a sequence of API calls. The learning model is built with two different recurrent neural network architectures, LSTM and GRU for comparison. The architecture comparison shows that LSTM is better than GRU. The test results show that the accuracy rates of the learning model using the LSTM architecture in binary classification and multiple class classification are 97.3% and 56.05%, respectively. In this study, we aim to build classification platform to classify malware using the classification model that has been made and enhancing the dataset by merging and update new data. The classification model testing result shown that 146 samples were correctly predicted, with an accuracy rate of 96.8%