Malware Detection Using Transformers-based Model GPT-2

Download

nazenin_şahin_tez.pdf

Date

2021-11-17

Author

Şahin, Nazenin

Metadata

Show full item record

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Item Usage Stats

1747
views

2166
downloads

The variety of malicious content, besides its complexity, has significantly impacted end-users of the Information and Communication Technologies (ICT). To mitigate the effect of malicious content, automated machine learning techniques have been developed to proactively defend the user systems against malware. Transformers, a category of attention-based deep learning techniques, have recently been shown to be effective in solving various malware problems by mainly employing Natural Language Processing (NLP) methods. In the present study, we propose a Transformers architecture to detect malicious software automatically. We present models based on GPT-2 (Generative Pre-trained Transformer 2), which performs assembly code obtained from a static analysis on PE (Portable Executable) files. We generated a pre-trained model to capture various characteristics of both malicious and benign assembly codes. That improves the model’s detection performance. Moreover, we created a binary classification model that used preprocessed features to characterize existing malicious and benign code pieces. The resulting binary classification model distinguishes between those code pieces by recognizing novel malware or benign assembly codes. Finally, we used GPT -2's pre-trained model to improve detection accuracy. The experiments showed that a fine-tuned pre-trained model and GPT-2's pre-trained model led to accuracy values up to 85.4\% and 78.3\%, respectively.

Subject Keywords

Malware Detection, Static Analysis, Transformers, GPT-2, NLP

URI

https://hdl.handle.net/11511/94947

Collections

Graduate School of Informatics, Thesis

Suggestions

OpenMETU
Core

Static Malware Detection Using Stacked Bi-Directional LSTM Demirci, Deniz; Acartürk, Cengiz; Department of Cybersecurity (2021-8-19) The recent proliferation in the use of the Internet and personal computers has made it easier for cybercriminals to expose Internet users to widespread and damaging threats. In order protect the end users against such threats, a security system must be proactive. It needs to detect malicious files or executables before reaching the end-user. To create an efficient and low-cost malware detection mechanism, in the present study, we propose stacked bidirectional long short-term memory (Stacked BiLSTM) based de...
Malicious code detection in android: the role of sequence characteristics and disassembling methods Gürkan Balıkçıoğlu, Pınar; Şırlancı, Melih; ACAR KÜÇÜK, ÖZGE; Ulukapi, Bulut; Turkmen, Ramazan K.; Acartürk, Cengiz (2022-11-01) The acceptance and widespread use of the Android operating system drew the attention of both legitimate developers and malware authors, which resulted in a significant number of benign and malicious applications available on various online markets. Since the signature-based methods fall short for detecting malicious software effectively considering the vast number of applications, machine learning techniques in this field have also become widespread. In this context, stating the acquired accuracy values in ...
Malicious code detection: run trace analysis by LSTM Şırlancı, Melih; Acartürk, Cengiz; Gürkan Balıkçıoğlu, Pınar; Department of Cybersecurity (2021-6) Malicious software threats and their detection have been gaining importance as a subdomain of information security due to the expansion of ICT applications in daily settings. A major challenge in designing and developing anti-malware systems is the coverage of the detection, particularly the development of dynamic analysis methods that can detect polymorphic and metamorphic malware efficiently. In the present study, we propose a methodological framework for detecting malicious code by analyzing run trace ou...
Empirical investigation of Internet banking usage in Turkey Daneshgadeh, Salva; Özkan Yıldırım, Sevgi; Department of Information Systems (2013) With the fast development of Information and Communication Technologies (ICT), internet banking has become more popular worldwide. This study empirically investigates the factors impact internet banking usage by Turkish bank customers. A unique Internet Banking Usage Model (IBUM) was developed in this study. The proposed model incorporated 10 factors named usefulness, ease of use, compatibility, control, social influence, risk, website features, alliance service, awareness of service and customization/perso...
NETWORK INTRUSION DETECTION WITH A DEEP LEARNING APPROACH Kültür, Ebru; Acar, Aybar Can; Department of Cybersecurity (2022-2-7) With the rapid growth of the information technology in several areas, providing security of those systems has gained more importance. As a result of this development in information technology, the complexity of cyber-attacks has also significantly increased. Therefore, traditional security tools such as Signature-based Intrusion Detection Systems (SIDS) have become insufficient for detecting new attacks. Intrusion Detection Systems (IDS) are used to monitor network traffic and capture malicious traffic. Tra...

Citation Formats

N. Şahin, “Malware Detection Using Transformers-based Model GPT-2,” M.S. - Master of Science, Middle East Technical University, 2021.