Selective Targeted Transfer Learning for Malware Classification

Data driven machine learning and deep neural models demand accessibility to high-quality, clean, and enormous datasets. Obtaining a labeled dataset is an expensive, challenging and time-consuming process, leading to the development of transfer learning (TL) methodology. TL leverages gained knowledge from a previously trained source model into specific yet similar task models with limited data domain coverage. For effective transfer, the training (source) and test (target) data may share similar or different marginal and conditional distributions. Negative transfer may occur, due to noise accumulated during learning iterations decreasing system performance metrics [1]. In this paper, we propose a selective targeted transfer learning (STTL) method to resolve the transferability between source and target with minimal data requirements to statically detect malicious Windows portable executable files. Kernel layers from deep models map the marginal distributions of the source and target domain into a common latent space while selective source feature and hard target samples selection draws the conditional distributions closer. Here we utilize benchmark Endgame Malware Benchmark for Research (EMBER) dataset which contains more than one million malware and benign samples, to validate our work. We automatically identify source, target pairs for three different malware families (banking trojan, adware, spyware) based on statistical measures and perform feature extraction/reduction (2381 features to 29, 28, 18 features) to formulate the new training dataset for effective targeted TL. For three different families (trojan, adware, spyware malwares) with varying dimensions, we prove that acquiring a small number of intentionally well-chosen samples from the target environment (2441, 2404, 3083 which is less than 14% of target sample count), we can drastically improve model accuracy to 90.8%, 94.4%, 93.5 % in comparison to the baseline transfer learning accuracy of 80.5%, 76.1 % and 62.2%, respectively. Although, EMBER data is used in this work, our novel algorithm works on different datasets (as evident by our previous paper [2]).