BiBE: A Self-supervised Contrastive Learning Architecture for Malware Detection

Malware detection has become significantly more difficult due to the constant evolution of malware and the emergence of various variants. While machine learning-based malware detection method solves the limitations of traditional methods to a certain extent, the vast majority of current work uses supervised learning methods, which require large sets of labeled data, which means a huge amount of manpower and time cost. Self-supervised learning can solve these problems by extracting information from unlabeled data for learning. In this paper, we introduce BiBE, a malware detection architecture based on self-supervised learning framework. We first preprocess the samples with normalization, complete the missing information of features, and perform vectorization processing. Then, after learning and encoding the sample features by setting proxy tasks, we use comparative learning to distinguish similar samples, achieve the division of positive and negative samples and assign pseudo-labels. Finally, the labeled samples and pseudo-labeled samples are put into the Bi-LSTM network to train the classifier to detect malware. Moreover, we also evaluate the model on a public dataset. The evaluation shows that the BiBE model has good convergence and generalization in training, achieves excellent detection performance, and outperforms other existing methods, verifying the feasibility of the BiBE model.