Zero-Day Malware Defence with Limited Samples

Abstract

Zero-day malware refers to a previously unknown or newly discovered type of malware. While most existing studies rely on large malware sample sets, their performance is unknown when dealing with a limited number of samples. This paper addresses this challenge by proposing a novel approach for effective zero-day malware detection, even with a scarcity of known samples. The proposed method begins by visualizing the malware binary and converting it into an entropy image. Subsequently, a deep convolutional generative adversarial network (DCGAN) is employed to learn from the available samples and generate new, highly similar synthetic samples. By combining these generated samples with the real ones, a comprehensive training set is constructed for a convolutional neural network (CNN) classification model. The randomness introduced by DCGAN facilitates the generation of new features, even in the presence of a small sample size. This enables the classifier to learn the characteristics of unknown zero-day malware and enhance its detection capabilities. Extensive experiments validate the effectiveness of the proposed approach, demonstrating that leveraging entropy images as features and applying DCGAN for data augmentation leads to a robust zero-day malware detection system, capable of achieving promising results even with a limited number of samples.