Reproduce “Malicious Code Detection: Run Trace Output Analysis by LSTM” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Cengiz Acarturk, Melih Sirlanci, Pinar Gurkan Balikcioglu, Deniz Demirci, Nazenin Sahin, Ozge Acar Kucuk
A new approach to malware detection treats assembly instruction and basic block sequences from dynamic execution traces as natural language, applying LSTM networks for classification. The Basic Block as a Sequence Model (BSM) achieved 99.26% accuracy, outperforming the instruction-level model by analyzing semantically richer code structures.
Key insights
- Dynamic analysis intrinsically resists polymorphic and metamorphic malware by observing actual execution behavior, providing robustness against obfuscation.
- Treating assembly code sequences from run traces as a form of natural language enables effective application of deep learning models, specifically LSTMs, for malware detection.
- Basic blocks, which group functionally related instructions, provide significantly richer semantic and structural information than individual instructions, leading to superior malware detection performance.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.