Multimodal Techniques for Malware Classification

Rapid development in technology has changed the way humans use and acquire knowledge and interact with society, leading to an increased reliance on personal computers and smart devices. In recent decades, valuable information has become available on the Internet and on personal computers, and such data is a natural target for cybercriminals [1]. Cybercrime and malware go hand-in-hand, and hence malware detection and classification are vital concerns in cybersecurity.

Windows Portable Executable (PE) files are the most common victims of malware attacks. Due to their popularity, malware creators often choose to attack PE file formats [21].

Traditional signature-based detection methods are fast, efficient, and accurate for known threats. However, due to their dependency on predefined patterns or signatures of known malware, they lack adaptability and are vulnerable to evasion techniques. Malware that can change its code structure while maintaining malicious functionality can easily escape from the signature-based antivirus scanning [12]. As a result, machine learning and deep learning techniques have become mainstays in the malware detection field.

In this research, we apply machine learning techniques to the problem of Windows PE malware classification using a multimodal approach. In this context, multimodal means that we apply machine learning techniques that combine multiple types of data, with the goal of improving the accuracy of the system. Specifically, in this paper, we train learning models on different parts of PE files, then train another machine learning model with the probability vectors of the component models serving as features. While copious previous research has trained trained a wide variety learning models on a wide range of features, (byte sequences, opcode sequences, API calls, various graph structures, features derived from code analysis, metadata, and so on, there is relatively little research that attempts to directly utilize the structure inherent in PE files [24, 39, 44].

This research expands upon traditional methods by focusing on the structural characteristics of PE files, which are composed of headers and various additional sections (heretofore referred to simply as sections) . We extract features from PE headers and from the PE sections. Then we train models just using the header-based features, we train models just using the sections-based features, and we train models using features from both the header and sections (i.e., the entire PE file). We then train multimodal learning models using the output of the header and section models as the feature vectors. In this context, the output of a model refers to the probability vector generated by the output layer of the model. We then compare the results of these different cases, namely header-based models, section-based models, models trained on the entire PE file, and multimodal models trained on the output of header and sections based models. Note that in the multimodal cases, the training of the header based model and the sections based model can be viewed as a feature engineering step, with the output of these models yielding additional features that may be more informative, as compared to the original features used to train the component models.

For the header-based, sections-based models, and the models trained on the entire PE file, we experiment with Support Vector Machines (SVM), Long Short-Term Memory (LSTM) models, and Convolutional Neural Networks (CNN). For the multimodal models we use SVMs to combine the output of the header-based and sections-based models.

The remainder of this paper is organized as follows. Section 2 introduces relevant background topics, including an overview of the PE file format and the learning models employed in our experiments. In Section 3 we discuss representative examples of relevant related work. Section 4 presents our experiment, including dataset preparation, feature extraction, model design, hyperparameter tuning, and so on. In this section, we also compare and analyze our results. Section 5 summarizes the key findings of this research and provides some suggestions for further work.

The Portable Executable (PE) file format is the standard for Windows executables. Due to their ubiquity, PE files are the predominant target for malware creators. According to a 2020 report from Kaspersky, nearly 90% of all malware detected daily occurred in PE files [20]. Given the frequency of this format in malware attacks, understanding the structure and functionality of PE files may be advantageous for malware analysis. Furthermore, a deep understanding of PE file structure facilitates the extraction of useful features for machine learning-based malware detection. Next, we provide an overview of the PE file format, which is followed by an introduction to the three types of machine learning models considered in this research.

In this section, we review examples of related work where PE file features have been used for malware classification. But first we mention that, in general, features used for malware analysis can be considered static or dynamic [9]. Static features are those that can be obtained directly from the the malware file, whereas dynamic features require code execution or emulation. Examples of static features include byte histograms and opcode sequences, whereas API calls and various graph-based features typically must be collected in a dynamic mode. Dynamic features are generally more robust with respect to obfuscation techniques, while it is typically fare more efficient to collect static features. In the experiments reported in this paper, we only consider static features.

In [2], the EMBER dataset is introduced and analyzed. This dataset consists of a large set of static features extracted from 1.1 million PE files. The features include byte histograms, metadata in the header, and import table characteristics. The result from this study shows that machine learning techniques applied to these static features can distinguish between malware and benign with good accuracy.

Rezaei et al. [34] proposed a method focusing on using features from the PE header. They combined deep learning techniques and clustering techniques with 324 bytes of the header to train a malware classification model. The result of this model show good accuracy in malware classification, even when faced with obfuscation techniques. Similarly, Kattamuri et al. [22] developed the SOMLAP dataset, which includes 51,409 samples, and from each sample, they extract 108 PE header attributes. They first apply feature reduction techniques using swarm optimization algorithms, including Ant Colony Optimization (ACO), Cuckoo Search Optimization (CSO), and Grey Wolf Optimization (GWO), which is followed by traditional machine-learning techniques. This research claimed to achieve a high malware detection accuracy. The two papers discussed in this paragraph illustrate the potential effectiveness of using header-based features.

Raff et al. [32] proposed an end-to-end deep learning approach that avoids the need for manual feature selection. This approach feeds the entire byte sequence of PE files directly into a neural network, skipping typical feature engineering steps. This allows the network to independently learn meaningful feature patterns. This approach showed high accuracy on large-scale datasets with one downside being heavy computational time. In addition, the technique struggled with obfuscated malware.

Damodaran [9] evaluated static, dynamic, and hybrid feature sets using Hidden Markov Models (HMMs). This paper highlights the trade-offs between different feature selection strategies and serves as a useful reference for optimizing feature selection methods. Static features like opcode sequences were found to be almost as effective as dynamic features in most cases. Hybrid approaches, which combine static and dynamic features, introduced additional complexity and failed to outperform standard approaches.

Finally, Wen and Chow [40] proposed a malware detection model based on CNNs. In this research, variable-size binary fragments obtained from PE files are considered. The research simulated real-world scenarios where network packet size limitations result in incomplete file captures, aiming to demonstrate the ability to deal with such fragmented input. The dataset was derived from antivirus tools and included examples of zero-day malware. Even with these challenges, the model still performed relatively well.

Table 1 summarizes the related work discussed in this section. Taken as a whole, these studies demonstrate that a wide variety of PE-based feature selection and extraction methods have been used to build high-performing malware detection systems. Typical features include header fields, byte sequences, specific sections of the file, and even the full binary content analyzed using learning techniques. Together, these features enhance the performance of both traditional machine learning and modern deep learning models in malware classification.

Multimodal Machine Learning (MML) has developed as an innovative approach, utilizing diverse data modalities to enhance the performance of models. In [3], Barua et al., review key advancements and challenges in MML, including the current state of the field, and they provide insights into challenges and potential solutions, while also discussing several frameworks and trends. One significant finding in this paper is the growing trend toward deep learning approaches. These approaches have gained attention due to their ability to effectively process complex multimodal data, particularly in areas such as representation learning, fusion techniques, and alignment strategies. Several deep learning architectures are mentioned for their contributions to MML applications, including CNNs, Recurrent Neural Networks (RNN), and transformer-based architectures.

In another paper, Zhai et al. [45] proposed an online classification model for darknet traffic classification that integrates a CNN and a Bidirectional Gated Recurrent Unit (BiGRU) to extract spatial and temporal features from packet payloads. To enhance the overall representation of network traffic, the model incorporates flow-level abstract features processed by a Multilayer Perceptron (MLP). The authors state that this multimodal approach improves accuracy across multiple categories while reducing time and memory consumption by approximately 50%. The authors claim that compared to state-of-the-art traffic classification models, the proposed method demonstrates superior classification performance.

Further, in [37], Shobhit and Bera proposed a deep learning-based malware detection system with a unique architecture that combines image representations, text representations, and Generative Adversarial Networks (GANs). This so-called ModCGAN system architecture comprises several key components, including an Image Autoencoder, a Text Autoencoder, and a GAN. They utilized log files containing API call sequences to generate both image and text representations. These representations are fed into the respective autoencoders and combined into a single feature vector. This feature vector is then used for malware classification purposes. The results demonstrated that this multi-modal approach effectively captures the dynamic behavior of malware, resulting in improved malware detection accuracy compared to traditional single-modality methods.

Lastly, in [14], Guo et al. propose another innovative approach called Multimodal Dual-Embedding Networks (MDENet), which they use to detect malware with highly similar features. MDENet leverages malware features from different modalities, such as malware images (generated from numeric features of malware samples) and malware “sentences” (created by organizing tokenized malware features into sentence-like structures). MDENet achieves good accuracy in both classifying known malware and detecting new, unknown families. Its effectiveness is validated through experiments on the popular Mailing dataset and the MAL-100+ dataset. This study provides further evidence of the value of a multimodal approach in addressing challenging malware problems.

In this section, we present experimental results comparing the performance of various multimodal approaches to typical machine learning models. We train models using histograms, byte sequences, and bytes interpreted as 2-dimensional images, depending on the model under consideration. For each of the three model types discussed in Section 2.2, namely, SVM, LSTM, and CNN, we train a model on the header, we train another model on the sections, and we train a third model on the entire file. Then we consider multimodal experiments, where we train an SVM on the output of each of the nine combinations of header and section models. We evaluate all of our models based on accuracy, which is computed as

where we have $\text{TP}=\text{True Positives}$, $\text{TN}=\text{True Negatives}$, $\text{FP}=\text{False Positives}$, and $\text{FN}=\text{False Negatives}$.

But, before we discuss our experimental results, we provide details on the dataset and features utilized in the experiments.

In this paper, we demonstrated the effectiveness of combining multiple machine-learning models in a multimodal sense can enhance malware classification accuracy. For our baseline cases, we trained SVM, LSTM, and CNN models on features extracted from the PE header, and on features extracted from the other sections of the PE file, and we also trained these same models on the overall PE file. We then generated multimodal models, where the output layer probabilities of a PE-header model and a PE-sections model were combined and used as feature vectors to train an SVM classifier. In this multimodal approach, we were able to take advantage of the unique strengths of specific learning techniques on different parts of the Windows PE file, which improved classification accuracy, as compared to the baseline cases.

There are many potential directions for improvements and extensions of the research presented in this paper. Testing the techniques considered in this paper on a larger, more diverse, and more challenging dataset would aid in more accurately quantifying the effectiveness of such a multimodal approach. We could also consider additional features, such as opcode sequences, API calls, and various graph structures, and we could employ advanced feature engineering techniques, such as Word2Vec [6]. In a similar vein, it has been demonstrated that the method used to generate images from raw data can affect the accuracy of CNN classifiers [35], and hence more sophisticated image-generation techniques should be considered. Experiments involving additional learning techniques would also be interesting—in particular, Graph Neural Networks have shown considerable promise in the malware domain [27], and such techniques are likely to provide unique strengths in a multimodal setting.

The results of all multimodal combinations tested are given in Figure A.1. For additional details on the multimodal experiments used to generate these results, see Section 4.5.