Application of Deep Belief Networks for opcode based malware detection

Deep belief nets (DBNs) have been successfully applied in various fields ranging from image classification and audio recognition to information retrieval. Compared with traditional shallow neural networks, DBNs can use unlabeled data to pretrain a multi-layer generative model, which can better solve the overfitting problem during training neural networks. In this study we represent malware as opcode sequences and use DBNs to detect malware. We compare the performance of DBNs with three widely used classification algorithms: Support Vector Machines (SVM), Decision Tree and k-Nearest Neighbor algorithm (KNN). The DBN model gives detection accuracy that is equal to the best of the other models. When using additional unlabeled data for DBN pre-training, DBNs performed better than the compared classification algorithms. We also use the DBNs as an autoencoder to extract the feature vectors of the input data. The experiments shows that the autoencoder can effectively model the underlying structure of the input data, and can significantly reduce the dimensions of feature vectors.