CNN and LSTM-Based In-Memory Malware Detection: Performance Improvement with Transfer Learning

Ozdemir S. N., KARATAŞ BAYDOĞMUŞ G., DEMİR Ö.

7th International Congress on Human-Computer Interaction, Optimization and Robotic Applications, ICHORA 2025, Ankara, Türkiye, 23 - 24 Mayıs 2025, (Tam Metin Bildiri) identifier

  • Yayın Türü: Bildiri / Tam Metin Bildiri
  • Doi Numarası: 10.1109/ichora65333.2025.11017308
  • Basıldığı Şehir: Ankara
  • Basıldığı Ülke: Türkiye
  • Anahtar Kelimeler: CNN, LSTM, malware detection, transfer learning
  • Marmara Üniversitesi Adresli: Evet

Özet

Malware detection has become increasingly complex in recent years. Traditional antivirus software and security tools struggle to keep pace with the rapid evolution of threats, often falling behind as new malicious techniques emerge. As a result, machine learning and AI-based approaches have emerged as valuable alternatives for detecting and classifying malware. Detecting malware directly from memory using conventional methods has proven to be a particularly difficult challenge. Consequently, deep learning and machine learning techniques have become more prominent in identifying hidden malware. This study demonstrates that combining Convolutional Neural Networks (CNN) with Long Short-Term Memory (LSTM) models yields an effective approach for malware detection. Additionally, utilizing transfer learning to fine-tune pre-trained models has proven to be a robust strategy for enhancing detection performance. In this research, the CIC-MalMem-2022 dataset was utilized. This dataset not only facilitates malware detection but also provides comprehensive insights into identifying specific malware types, offering a more granular understanding of malicious behaviors.