Stealthy Malware Detection Based on Deep Neural Network

Abstract

Network attacks using advanced local hiding technology have not only increased, but also become a serious threat. However, attacks using these technologies can not be detected through traffic detection, and some attacks imitate benign traffic to avoid detection. To solve these problems, a malware process detection method based on process behavior in possibly infected terminals is proposed. In this method, a deep neural network is introduced to classify malware processes. Firstly, the recurrent neural network is trained to extract the characteristics of process behavior. Secondly, training convolutional neural network is used to classify feature images generated by trained RNN features. The experiments results show that this method can effectively extract the features of malicious processes, and the AUC of ROC curve is 0.97 in the best case.