Spatiotemporal analyses of data by using deep learning for malware classification

Abstract In recent years, to combat the increasing threat of malware, the use of artificial intelligence has become widespread. The lack of enough training samples and the need for parallel analysis through previously introduced methods have led to several limitations in real-world applications. In some previous research, malware executables are visually converted into images to facilitate the extraction of suitable features for malware classification, with extensive techniques applied to two-dimensional data. The use of better features will lead to faster and more accurate classification of existing and new malware. In this paper, we propose a combination of modified convolutional neural networks and recurrent blocks to classify malware types with high accuracy. Furthermore, by resolving the imbalance between classes and updating the existing samples in the widely used Malimg and Microsoft BIG datasets, the limitations of learning, especially in low-sample classes, have been addressed. The proposed method extracts features from both long short-term dependencies within a structure. Instead of spending time and costs associated with collecting new samples, utilizing an appropriate structure, employing balanced training, and simultaneously extracting features, it has achieved promising results with low detection time. The results showed an accuracy of 99.63%, an F1 score of 99.63%, and a prediction time of 3.07 ms for the proposed method on the Malimg dataset. Similarly, the model achieved 99.26% accuracy, 99.26% F1-score, and a prediction time of 3.06 ms on the Microsoft BIG dataset. These results are favorable in all classes and demonstrate the method’s practical reliability.