Using DTL-MD with GANs and ResNet for Malicious Code Detection

Abstract

This study proposes a malicious code detection model DTL-MD based on deep transfer learning, which aims to improve the detection accuracy of existing methods in complex malicious code and data scarcity. In the feature extraction process, the weighted sum method of GIST and LBP features is used to combine the advantages of the two features. Online transfer learning is used to reduce the data distribution difference between the target domain and the source domain. The model uses ResNet50V2 as the backbone network and combines SimAM to enhance the feature extraction and representation capabilities. In addition, in order to further improve the robustness of detection, GAN is used to generate malicious code variants and expand the training data set. In the experiment, the public CICIDS 2017 data set is used for model training and testing. The performance test results show that when the threshold is 0.7, the accuracy of DTL-MD is 95.8% and the F1 score is 0.93. In a performance test involving 30,000 samples, the throughput of the DTL-MD model under Trojans, viruses, worms, and adware is 11, 12, 11, and 12 tasks/s, respectively, and the inference time is 211, 225, 239, and 234 samples/s, respectively. Compared with GAN, DTL-MD increases the throughput by about 10% and the inference speed by about 15%. The research aims to provide new ideas for improving the intelligence and automation level of malicious code detection technology, which has certain application value and practical significance.