Malware detection using spatial pyramid pooling with convolutional neural networks

Abstract

The proliferation of malware and the increased availability of computation devices has made malware detection an important task. Large quantities of malware belonging to various families are produced every day. Modern methods like polymorphism and metamorphism are being used to obfuscate malware which makes them difficult to detect using static analysis. Dynamic analysis techniques are also being used through executing in a sandbox environment and analyzing the behaviour of the malware. This method is difficult to apply to a large number of files owing to the time intensive process. A convolutional neural network is a type of neural network which is particularly useful for image feature classification. This research explores convolutional neural networks for the classification of files into either malware or benign categories. Convolutional neural networks can take variable sized images in the convolution layer and the pooling layer; while the fully connected layer works with fixed size images. This requirement means that cropping or warping filter needs to be applied to malware images so they may conform to a standard size. This process is counter intuitive since applying filters to image files contaminates the features. This thesis explores the design and implementation of spatial pyramid pooling algorithm in convolutional neural networks as a means of allowing variable sized malware images. The thesis also studies the creation of a comprehensive dataset composed of both malware and benign files. Training the proposed convolutional neural network with the supplied dataset has shown that the spatial pyramid pooling algorithm allows working with variable sized images and results in a high accuracy rate.