A New Method for Malware Detection Based on Energy

The constant growth in the number of malware - software or code fragment potentially harmful for computers and information networks - and the use of sophisticated evasion and obfuscation techniques have seriously hindered classic signature-based approaches. On the other hand, malware detection systems based on machine learning techniques started offering a promising alternative to standard approaches, drastically reducing analysis time and turning out to be more robust against evasion and obfuscation techniques. In this paper, we give a semi-supervised malware detection and classification system based on energy. In this system, we have access to only anomaly-free training data and want to detect and identify malware of an arbitrary nature on test data. We employ the density estimates from the energy-based model as normalcy scores that can be used to discriminate normal code from malware ones. Further, we back-propagate the gradients of the energy score with respect to the code in order to generate a gradient map that provides code localization of the malware. To quantitatively validate the performance of the proposed method, We tested the proposed method on the open source dataset, containing approximately 20 thousand PE samples, analyzed through static analysis. Obtained malware detection results are comparable to other academic works in the current state of art. Models used in the method provides interpretable results which can help security analysts in better understanding for malware.