Self-evolving Malware Detection for Cyber Security using Network Traffic and Incremental Learning

International Conference on Dependable Systems and Their Applications (DSA), pp. 454–463

Abstract

Malware detection is an important step in network security. Traditional malware detection methods suffer from the ability to learn, understand, process, and apply characteristics of network traffic data accurately, and in a relatively short space of time. It also cannot learn new tasks without forgetting the old tasks. In this paper, we propose a self-evolving malware detection (SEMD) method using network traffic and incremental learning. Incremental learning (IL) method is one of the important methods in deep learning, which can learn new tasks without forgetting the old tasks. Its loss function draws lessons from the idea of knowledge distillation. Experimental results show that the proposed method can recognize both old tasks and new tasks (overcoming the problem of catastrophic network forgetting). The performance of the proposed SEMD method is also better than the general method of incremental learning without self-evolving.

Authors 8

1. Xiaohu Xu

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering, NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China

2. Yifei Liang

   Northeastern University

   Affiliation as printed

   School of Mechanical Engineering and Automation, Northeastern University,Shenyang,China

   School of Mechanical Engineering and Automation, Northeastern University, Shenyang, China

3. Xixi Zhang

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering, NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China

4. Yu Wang

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering, NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China

5. Yun Lin

   Harbin Engineering University

   Affiliation as printed

   College of Information and Communication Engineering, Harbin Engineering University,Harbin,China

   College of Information and Communication Engineering, Harbin Engineering University, Harbin, China

6. Bamidele Adebisi

   Manchester Metropolitan University

   Affiliation as printed

   Manchester Metropolitan University,Faculty of Science and Engineering,Manchester,United Kingdom

   Faculty of Science and Engineering, Manchester Metropolitan University, Manchester, United Kingdom

7. Haris Gacanin Aachen Institute for Communication Technologies and Embedded Systems

   RWTH Aachen University

   Affiliation as printed

   Institute for Communication Technologies and Embedded Systems, RWTH Aachen University,Aachen,Germany

   Institute for Communication Technologies and Embedded Systems, RWTH Aachen University, Aachen, Germany

8. Guan Gui

   Nanjing University of Posts and Telecommunications

   Affiliation as printed

   College of Telecommunications and Information Engineering, NJUPT,Nanjing,China

   College of Telecommunications and Information Engineering, NJUPT, Nanjing, China