MALITE: Lightweight Malware Detection and Classification for Constrained Devices

Abstract

Today, malware is one of the primary cyber threats to organizations, pervading all types of computing devices, including resource constrained devices such as mobile phones, tablets and embedded devices like Internet-of-Things (IoT) devices. In recent years, researchers have leveraged machine learning based strategies for malware detection and classification. However, malware analysis approaches can only be employed in resource constrained environments if the methods are lightweight in nature. In this paper, we present MALITE, a lightweight malware analysis system, that can distinguish between benign and malicious binaries and classify various malware families. MALITE converts a binary into a grayscale or an RGB image requiring low memory and battery power consumption and uses computationally inexpensive malware analysis strategies. We have designed MALITE-MN, a lightweight neural network based architecture and MALITE-HRF, an ultra lightweight random forest based method that uses histogram features extracted by a sliding window. An extensive empirical evaluation is conducted on seven publicly available datasets (Malimg, Microsoft BIG, Dumpware10, MOTIF, Drebin, CICAndMal2017 and MalNet), and performance is compared to four state-of-the-art baselines. The results show that MALITE-MN and MALITE-HRF not only accurately identify and classify malware but also respectively consume several orders of magnitude lower resources (in terms of both memory as well as computation capabilities), making them much more suitable for resource constrained environments.