TY - GEN
T1 - Unveiling the Efficacy of BERT’s Attention in Memory Obfuscated Malware Detection
AU - Arifin, Md Mashrur
AU - Tolman, Troy Suyehara
AU - Yeh, Jyh Haw
N1 - Publisher Copyright:
© The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
PY - 2025
Y1 - 2025
N2 - The study addresses the challenge of detecting obfuscated malware, particularly memory-obfuscated variants, which evade conventional detection methods by targeting a system’s volatile memory. By leveraging transformer-based models, notably BERT, the research demonstrates promising advancements in malware detection. Through data augmentation and rigorous feature selection processes, the study enhances the CIC-MlMem-2022 dataset, improving its quality for training classification models. Comparative analysis with conventional machine learning techniques highlights the superior performance of BERT and DistilBERT, achieving approximately 74% accuracy in classifying malware families. Notably, BERT exhibits exceptional capability in generalizing to unseen malware, achieving a remarkable 100% success rate in categorizing new families. These findings underscore the potential of transformer-based models for effectively detecting obfuscated malware, emphasizing the need for intelligent detection mechanisms in cybersecurity.
AB - The study addresses the challenge of detecting obfuscated malware, particularly memory-obfuscated variants, which evade conventional detection methods by targeting a system’s volatile memory. By leveraging transformer-based models, notably BERT, the research demonstrates promising advancements in malware detection. Through data augmentation and rigorous feature selection processes, the study enhances the CIC-MlMem-2022 dataset, improving its quality for training classification models. Comparative analysis with conventional machine learning techniques highlights the superior performance of BERT and DistilBERT, achieving approximately 74% accuracy in classifying malware families. Notably, BERT exhibits exceptional capability in generalizing to unseen malware, achieving a remarkable 100% success rate in categorizing new families. These findings underscore the potential of transformer-based models for effectively detecting obfuscated malware, emphasizing the need for intelligent detection mechanisms in cybersecurity.
KW - BERT-based Models
KW - Malware Detection
KW - Memory Obfuscated Malware
UR - http://www.scopus.com/inward/record.url?scp=105000434077&partnerID=8YFLogxK
U2 - 10.1007/978-981-97-9053-1_16
DO - 10.1007/978-981-97-9053-1_16
M3 - Conference contribution
AN - SCOPUS:105000434077
SN - 9789819790524
T3 - Lecture Notes in Computer Science
SP - 273
EP - 291
BT - Information Security Practice and Experience - 19th International Conference, ISPEC 2024, Proceedings
A2 - Xia, Zhe
A2 - Chen, Jiageng
PB - Springer Science and Business Media Deutschland GmbH
T2 - 19th International Conference on Information Security Practice and Experience, ISPEC 2024
Y2 - 25 October 2024 through 27 October 2024
ER -