DeepAI AI Chat
Log In Sign Up

CNS-Net: Conservative Novelty Synthesizing Network for Malware Recognition in an Open-set Scenario

by   Jingcai Guo, et al.

We study the challenging task of malware recognition on both known and novel unknown malware families, called malware open-set recognition (MOSR). Previous works usually assume the malware families are known to the classifier in a close-set scenario, i.e., testing families are the subset or at most identical to training families. However, novel unknown malware families frequently emerge in real-world applications, and as such, require to recognize malware instances in an open-set scenario, i.e., some unknown families are also included in the test-set, which has been rarely and non-thoroughly investigated in the cyber-security domain. One practical solution for MOSR may consider jointly classifying known and detecting unknown malware families by a single classifier (e.g., neural network) from the variance of the predicted probability distribution on known families. However, conventional well-trained classifiers usually tend to obtain overly high recognition probabilities in the outputs, especially when the instance feature distributions are similar to each other, e.g., unknown v.s. known malware families, and thus dramatically degrades the recognition on novel unknown malware families. In this paper, we propose a novel model that can conservatively synthesize malware instances to mimic unknown malware families and support a more robust training of the classifier. Moreover, we also build a new large-scale malware dataset, named MAL-100, to fill the gap of lacking large open-set malware benchmark dataset. Experimental results on two widely used malware datasets and our MAL-100 demonstrate the effectiveness of our model compared with other representative methods.


page 1

page 8

page 9

page 13


MDENet: Multi-modal Dual-embedding Networks for Malware Open-set Recognition

Malware open-set recognition (MOSR) aims at jointly classifying malware ...

Detecting Unknown DGAs without Context Information

New malware emerges at a rapid pace and often incorporates Domain Genera...

Deep Learning and Open Set Malware Classification: A Survey

As the Internet is growing rapidly these years, the variant of malicious...

Classification and Online Clustering of Zero-Day Malware

A large amount of new malware is constantly being generated, which must ...

Learning a Neural-network-based Representation for Open Set Recognition

Open set recognition problems exist in many domains. For example in secu...

TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time

Academic research on machine learning-based malware classification appea...

An In-Depth Study on Open-Set Camera Model Identification

Camera model identification refers to the problem of linking a picture t...