Static Detection of Novel Malware Using Transfer Learning with Deep Neural Networks

Signature matching and heuristic detection struggle with custom malware that has never been seen before. The speakers describe an alternative in which Windows executables are turned into grayscale images and fed to an image-recognition network that has been pretrained and then retrained for malicious-versus-benign classification. Because nothing in the file is executed, the approach counts as static detection, and it avoids the lengthy feature engineering that typical machine learning pipelines require.

The work starts from an Intel and Microsoft method whose dataset is proprietary, so the team rebuilt a comparable collection. Malicious samples came from a public malware repository, while benign files were gathered from fresh Windows 10, Windows Server 2019 and Cygwin installations, in sets of roughly 10,000 and 15,000 per class. The team swapped the original table-based image sizing for a simple square-root layout with nearest-neighbor scaling, which performed better in their tests. DenseNet-201 gave the highest accuracy, about 96.5 percent. Accuracy dropped on samples from certain advanced threat groups, and file-size imbalance between classes was offered as a likely cause.

The main bottleneck identified was the scarcity of legally shareable benign binaries, which makes reproducing results hard. The presenters plan to release code, conversion tools and trained models under a permissive license, and they outlined future directions such as one-shot learning and multi-class labeling by malware family. Closing questions stressed that closed-source vendors rarely explain their methods, so independent testing on held-out malware matters.