A Natural Language Processing Approach to Malware Classification
Ritik Mehta Olha Jurečková Mark Stamp
Many different machine learning and deep learning techniques have been
successfully employed for malware detection and classification. Examples of
popular learning techniques in the malware domain include Hidden Markov Models
(HMM), Random Forests (RF), Convolutional Neural Networks (CNN), Support Vector
Machines (SVM), and Recurrent Neural Networks (RNN) such as Long Short-Term
Memory (LSTM) networks. In this research, we consider a hybrid architecture,
where HMMs are trained on opcode sequences, and the resulting hidden states of
these trained HMMs are used as feature vectors in various classifiers. In this
context, extracting the HMM hidden state sequences can be viewed as a form of
feature engineering that is somewhat analogous to techniques that are commonly
employed in Natural Language Processing (NLP). We find that this NLP-based
approach outperforms other popular techniques on a challenging malware dataset,
with an HMM-Random Forrest model yielding the best results.