Learning the PE Header, Malware Detection with Minimal Domain Knowledge
This addresses malware detection for security applications, but it is incremental as it builds on existing neural network methods with a specific data restriction.
The paper tackled malware detection by applying neural networks with minimal domain knowledge, using only a portion of the PE header, and showed that neural networks outperform domain knowledge approaches that parse the header into explicit features.
Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge, namely byte n-grams and strings. In this work we explore the feasibility of applying neural networks to malware detection and feature learning. We do this by restricting ourselves to a minimal amount of domain knowledge in order to extract a portion of the Portable Executable (PE) header. By doing this we show that neural networks can learn from raw bytes without explicit feature construction, and perform even better than a domain knowledge approach that parses the PE header into explicit features.