Real-time Deep learning-based malware detection using static and

dynamic features

Keywords: Malware, Threat Detection, Neural Network, Static Features, Dynamic Features

Abstract: Cyber-security industry has been the home of various machine learning approaches meant to be more proac-
tive when it comes to new threats. In time, as security solutions matured, so did the way in which artificial
intelligence algorithms are being used for specific contexts. In particular, static and dynamic analysis of a
threat determines certain characteristics of an artificial intelligence algorithm (such as inference speed, mem-
ory usage) used for threat detection. While from a product point of view, static and dynamic analysis of a
threat target separate product features such as protection for static analysis and detection for dynamic anal-
ysis, the feature sets derived from analyzing threats in those two scenarios (static and dynamic analysis) are
complementary and could improve the accuracy of a model if used together. The current paper focuses on a
multi-layered approach that takes into consideration both static and dynamic analysis of a threat.

1 INTRODUCTION itive rate as they can not block anything. As such they
are usually allowed a certain level of false positive
The cyber-security industry has evolved along with if the detection rate is increased. Another important
the constant increase of attacks that led to more than observation is that the output of these models is usu-
1.2 billion1 known malware in 2023. Nowadays, most ally analyzed by a SOC2 team that determines if an
of the cyber-security solutions rely on different ma- attack was identified or not. This behavior led to a
chine learning algorithms for threat detection. phenomenon called alert fatigue - meaning that alerts
At the same time, cyber-security solutions evolved from these models accumulate to a point where they
in an attempt to cover various needs from both con- are hard to sort and analyze by security officers from
sumer and business markets. One of the major differ- companies.
ences in these cases is that while consumers are more Our paper focuses on a method that combines two
focused on protection (the role of a security solution types of models: based on statically extracted features
being to make sure that nothing bad happens to a sys- and models designed for detection, with the purpose
tem), the business solution also focuses on providing of reducing the alert fatigue phenomena while pre-
visibility around an attack. Most of the requirements serving a high detection rate. For this purpose we
that appear in the business market are a direct result of have used multiple malicious files that were analyzed
several compliance rules that enterprises have to obey. from a dual perspective:
For example, if a cyber-security attack succeeds on a • a static analyses perspective where we extract
bank, the bank is required to start an internal inves- features based on meta information we can extract
tigation that analyzes logs and additional attack arti- from the malicious files
facts to better understand the impact of that attack.
With this, requirements for a new type of machine • a dynamic analysis perspective where we extract
learning algorithm emerge, that focuses on the behav- features that reflect the malware behavior in run-
ior of an attack and uses logs or asynchronously ob- time.
tained events to create features that are further going The rest of the paper is organized as follows: sec-
to be used by the algorithm. These algorithms cannot tion 2 reveals similar research, section 3 describes
block a threat but can provide late triggers about an the current cyber-security landscape and the problem
undergoing attack. These triggers are often referred we are tackling, section 4 presents our approach on
to as detection capabilities as they do not provide any building a neural network that uses both statically and
protection. dynamically extracted features, section 5 shows the
As a general observation, model designs for de- databases used in our experiment and several results
tection don’t necessarily need to have a low false pos-
1 https://www.av-test.org/en/statistics/malware/ 2 Security Operation Center
and finally, section 6 draws several conclusions on the cryption is being used for creating malicious files. In
practical aspects of our proposal. a recent study (Aghakhani et al., 2020) this aspect was
investigated and, using a dataset of almost 400 thou-
sand executables, it was demonstrated that using static
2 RELATED WORK information exclusively isn’t indicative of the actual
behavior of the classified files and a substantial num-
Over the last decade, malware detection has been one ber of false positives on packed benign files occur.
field that attracted a lot of attention from researchers Dynamic
who used various machine learning methods. There The other main approach would be to extract dy-
are two main approaches that are usually employed namic features that describe the behavior of the mal-
when it comes to deciding what features will be used ware during execution or partially retain information
in the process of training and evaluating machine regarding the said behavior.
learning models. One method is to include dynamic runtime op-
Static codes as input features, allowing the behavior of ex-
The first approach involves extracting static fea- ecutables to be captured. An extensive study (Carlin
et al., 2019) showed that this approach can accurately
tures from the files, without executing them. Thus,
detect malware, even on a continuously growing and
this approach usually consumes fewer resources and
updatable dataset that requires retraining. The authors
reaches high speed and potentially high accuracy.
compared 23 machine learning algorithms and con-
(Ahmadi et al., 2016) proposed a malware fam-
cluded that their method worked best using the Ran-
ily classification system, using a wide range of static
dom Forest model.
features extracted from the original PE executable
In a recent study (Zhang et al., 2023), the authors
files that were not unpacked or deobfuscated. By
combining the most relevant feature categories and proposed another method of combining the API call
feeding them to a XGBoost-based classifier, their sequences-based dynamic features with the semantic
model reached an accuracy of around 99.8% on the information of functions, bringing more context to the
Microsoft Malware Challenge dataset (Ronen et al., actual performed action by the API call. Compared
2018) of 20000 malware samples. to existing similar experiments that only used API
Other approaches demonstrated that minimal call information, their solution shows improvements
knowledge is needed for extracting relevant static fea- of 3% to 5% in detection accuracy.
tures from executable files. For instance, a study Static + dynamic separately
demonstrated that effective malware detection can be (Ijaz et al., 2019) compare several methods based
obtained using the information in the first 300 bytes on machine learning for detecting Windows OS ex-
from the PE header of executable files as input (Raff ecutables. They use a small set of files of only
et al., 2017b). The same year, a more comprehen- 39000 malicious binaries and 10000 benign ones,
sive study (Raff et al., 2017a) presented MalConv, a from which they statically extract a small set of 92
deep convolutional neural network model which di- features from the PE headers using the PEFILE tool.
rectly uses the raw byte representation of executable They also dynamically extract 2300 features from a
(limited to the first 2 MB) as input, without any intelli- small part of the files from the execution in Cuckoo
gent identification of specialized structures or specific Sandbox. Their detection measurements are made us-
executable or malware content. The model showed ing either the static features or the dynamic features
good results, achieving 94% accuracy after training separately. Also, using a sandbox for the training
on a large dataset of 2 million PE files. and evaluation part when using the dynamic features
In a more recently conducted study (Zhao et al., brings in a series of disadvantages, because it does
not provide a form of real-time protection for the new
2023), the authors researched a different method, con-
malicious files that would need to be evaluated.
verting the bytecode extracted from the original files
Hybrid
into color images and using them as input features
In one of the first such approaches, (Santos et al.,
for training an AlexNet convolutional neural network
2013) present a hybrid malware detection system that
(CNN). The results were promising, the accuracy of
combines both static and dynamic features. The small
their model reaching more than 99% on two rather
dataset they use consists of 1000 malicious programs
small public malware datasets from Google Code Jam
and Microsoft of around 10000 samples. and 1000 legitimate executables, from which they ex-
However, using static features alone might bring tract two-byte opcodes, perform feature selection us-
some limitations in real-world malware detection sce- ing Information Gain and select the first 1000 as the
narios where advanced obfuscation, packing or en- static features that will be used. The dynamic charac-
teristics are extracted by monitoring the behavior of • static detection - usually associated with pre-
the programs in a controlled sandboxed environment. execution / on-access scanners. The main char-
Another different hybrid approach that uses both acteristic of this type of detection is that it takes
static and dynamic features for malware detection is a file as an input (but a file that was not executed
proposed in (Zhou, 2019). The authors use a sandbox yet) and analyzes it (in terms of its content). Se-
for recording API call sequences from the execution curity products refer to this type of detection as
of 90000 malicious and benign files and they extract protection as that file is not executed yet and de-
dynamic features out of a trained RNN model that is tecting it at this point blocks the attack and keeps
fed with the recorded sequences. The static and dy- the user protected. This is heavily used in con-
namic features are then combined into custom images sumer products where the expectation is to block
that will be used in the training and validation phase everything and keep the user protected.
of a CNN model. Both studies demonstrate how com- • dynamic detection - usually associated with post-
bining both static and dynamic characteristics as input execution scanners. It implies that the file is al-
features for their models brings improvements in de- lowed to run, while at the same time its actions are
tection rates. monitored. This type of detection is better at iden-
Compared to our approach, these two studies have tifying behavior and intent, but it’s less resilient in
a few limitations, one related to the small number of terms of protection (once some data is copied to
files used in the dataset and another related to the us- an external site, even if we record the event, we
age of a sandbox for extracting dynamic features dur- cannot un-copy it). Enterprise solutions use this
ing execution. Thus, their systems could provide only method as part of EDR/XDR products to record
offline detection and classification mechanisms and data related to an attack and automatically create
are no practical solutions for a product which must a root cause report.
provide real-time protection against malware.
From a detection point of view (and in particular,
if we refer to machine learning models) there are sev-
eral distinct features that each of these two detection
3 PROBLEM/SECURITY methods (static and dynamic) have:
LANDSCAPE • static detection methods are usually used in the
pre-execution phase. This actually means that for
The cat-and-mouse game has been a constant of the example, before a file gets executed, its content
cyber-security ecosystem for decades; malicious ac- is scanned. From a technical perspective, this is
tors create a new threat, cyber-security solutions adapt achieved via a kernel mode driver that stops the
then the new threats adapt to the new cyber-security execution until the result from the scanner is avail-
changes and the cycle goes on. And while this type of able. While this method ensures protection (noth-
change is inevitable, there were other (more business- ing gets executed unless it was scanned), it also
related) changes that a security product suffered dur- imposes certain limitations. If for example, the
ing the years. duration of a scan is one second for each file,
One such important change was the split between the entire operating system will be heavily slowed
types of users: enterprise and consumer. While con- down. As such, models that are used in this phase
sumer users are more interested in protection (the have to be fast (fewer neurons or other forms
security solution is perceived as a tool that quietly of more classical machine learning approaches
ensures that everything is secured), the business en- such as binary decision trees, random forests, etc).
vironment comes with several different challenges. It’s also important to notice that features used in
When a breach happens, there is a need (sometimes these methods are extracted directly from the file
driven by compliance regulations) to understand ex- content (strings, section information, disassembly
actly what endpoints were affected, what kind of data listings, imports and exports, etc) and don’t reflect
was exfiltrated, when the attack started or what set of the behavior of a sample but rather a probability of
measures would reduce the chance for a similar attack something being malicious.
to happen in the future.
While these differences relate mostly to a prod- • dynamic detection on the other hand is used with
uct feature (centralized dashboard, reports for en- events that are recorded asynchronously. As such,
terprise environment and automated flows for con- the performance impact is reduced and assuming
sumer), there are several differences that regard threat storage space is not an issue, larger models (e.g.
detection as well. As a result, threat detection differ- neural networks with multiple hidden layers) can
ences can be classified in regards to: be used. It is also worth mentioning that the input
 Static Dynamic
Detection Detection
Susceptible to packers and Yes No
obfuscation techniques
Behavior false positive No Yes
(use of startup registry
keys)
Susceptible to dynamic No Yes
detection evasion techniques
(behave differently if
monitored)
Table 1: Static vs dynamic detection

to these models reflects behavior (system events,

APIs that are being used, etc).
As a general concept, a security solution uses
these two forms of detection sequentially (first a file
is scanned with the static scanner, then if nothing is
found it gets executed and the dynamic scanner ana-
lyzes it). However, each one of these two solutions
comes with several limitations in terms of detection -
as shown in table 1. Figure 1: Proposed solution
Since these evasion techniques are often used by
advanced malware in different stages of an attack, us- By having different sections of the neural network
ing just one of these detection methods or both but that process static and dynamic features, we are able
sequentially may be ineffective. to train neurons in these two sections separately. This
makes it possible to overcome a situation where for
training purposes, there is a lack of dynamic data but
4 SOLUTION an abundance of static data (as we will show later on,
this is the case).
In order to address the problem of advanced malware An important point to make is that our solution
detection, we set on developing a neural network that could perform well even against fileless malware.
classifies a program as benign (labeled 0) or mali- Fileless malware infects legitimate programs already
cious (labeled 1) by analyzing static features of the present on the endpoint. Our solution could ascertain
program’s file as well as dynamic features of the pro- the expected behavior of a legitimate program based
cess runtime behavior. Our solution targets PE files on the static analysis of the executable file and com-
(EXE and DLL). pare it with the actual runtime behavior. Thus, if un-
To aid this approach, we designed the neural expected suspicious actions occur that are indicative
network with two branches that process static and of a fileless malware attack, a detection may be raised
dynamic features separately. Results from these two with greater accuracy.
branches are concatenated and then fed to layers
responsible for correlating static with dynamic data. 4.1 Static component
The diagram in figure 1 displays this architecture.
The branch that analyzes static features is made up of
the first 4 layers of the neural network displayed in
figure 2. This neural network was trained as a self-
contained model and then used to initialize weights
and biases in the static feature branch of the final
model.
The neural network in figure 2 takes as input
static features of a PE file. These features consist of
both boolean and numeric values. In order to extract
static features we used an AntiMalware engine that
analyzes the structure and contents of the file.
 of the used sensors are API hooks, network probes
and Event Tracing for Windows.
Examples of examined events and the correlation
logic used for extracting dynamic features are found
in table 3. The resulting dynamic features consist of
both boolean and numeric values.

Figure 2: Layers for static features

Examples of static features that were utilized are

found in table 2. Some of the features listed below
may be represented as fixed-length collections of nu-
meric or boolean values (for example, the APIs his-
togram).
Figure 3: Layers for dynamic features
File header characteristics
Byte histogram
Used APIs histogram
Specific library imports Event name Example of dynamic feature
Byte patterns specific to known behavior (for exam- A process with suspicious command
Process create
ple, decoding memory section with XOR) line arguments was created
Known packer type used by file Code was injected into a running pro-
Process inject
cess
Table 2: Examples of static features
Process load A suspicious module was loaded
module through DLL Search Order Hijacking
Process API A process called an asymmetric en-
4.2 Dynamic component
call cryption API
Similar to the static component, the branch that ana- Windows
A process performed a suspicious op-
lyzes dynamic features is made up of the first 4 layers Management
eration through Windows Management
of the neural network displayed in figure 3. This neu- Instrumenta-
Instrumentation
ral network was trained as a self-contained model and tion operation
then used to initialize weights and biases in the dy- Registry A value was written in a registry startup
namic feature branch of the final model. value write key
The neural network in figure 3 takes input dy- Network con- A process made an HTTP connection
namic features extracted based on the process behav- nect to an untrusted domain
ior at runtime. In order to obtain these features we A file was created that has a name spe-
File create
used an EDR security solution (Endpoint Detection cific to a ransomware note
and Response). The EDR solution is installed on the Multiple user files were deleted - possi-
File delete
machine and it extracts dynamic features in real-time ble destruction of data
by monitoring the process at runtime and the entire Table 3: Examples of runtime events and dynamic features
system at large.
The EDR solution correlates a sequence of events
representing actions done by the process. Multiple
sensors installed on the machine monitor operations
and send events to the correlation component. Some
4.3 Evaluation triggers
The proposed neural network is meant to be integrated
into an EDR security product where performance im-
pact is of the essence. This requires an efficient eval-
uation mechanism for the neural network.
Dynamic features are extracted as the program
is running. The evaluation mechanism must decide
when to perform a neural network inference in order
to detect a malware program as early in its execution
as possible. In order not to affect performance, infer-
ence should be performed only a limited number of
times per period and only when it is relevant. Figure 4: Evaluation triggers and steps
The diagram in figure 4 displays the evaluation
mechanism we have chosen for EXE files. The
mechanism for DLL files is similar but evaluation As shown above, for evaluation to be triggered,
may start only after a process has loaded the DLL static features of the EXE file must be available and a
module. process needs to have started execution based on said
EXE file. If those conditions are met, evaluation is
triggered in the following cases:
• 1 second into the process execution
• on receiving a suspicious dynamic feature, but
only after the evaluation lockout period
• after the process is terminated
After each time an evaluation is performed, an
evaluation lockout period is put in place for said pro-
cess in order to prevent a flood scenario that would
impact performance. The evaluation lockout period
lasts 15 seconds.
The evaluation triggers and overall logic is similar
for DLL file analysis.

5 RESULTS

5.1 Database
We used a private dataset containing 5455942 PE
files, of those 4068535 are labeled benign and
1387407 are labeled malicious. The reason for the
dataset containing 75% benign files is to reflect that
on a typical computer, there are many more benign
files than malicious ones. As such, this ratio helps us
avoid a model prone to false positive alerts.
The static features representing the PE file struc-
ture were extracted using a component of an AntiMal-
ware solution. Examples of static features are found
in table 1.
There were more than 150000 static features ex-
tracted for each file. Much like in (Dahl et al., 2013)
we had to reduce the number of features that would
be used for the model based on static features. The
total uncompressed size of the extracted static data
was 5.5TB. In order to perform feature selection on
such a large quantity of data in a reasonable amount
of time we had to do the selection in multiple steps.
These consecutive steps are described by the function
Select.

function Select (D, limit, S, c);

Input : D dataset
limit the maximum amount of data
able to be processed
S selection methods
c maximum length of set A
containing relevant features

Output: Set A with the most relevant

features

A = all f eatures(D);
do
largest n s.t. n ∗ len(A) < limit;
d = n random instances with features(D,
n, A);
k = max(c, len(A)/2);
A = {};
for select K best in S do
A = A ∪ select k best(d, k);
end
while len(A) > c;
Algorithm 1: Progressively select the best features
of the dataset

The methods that we used for selecting the best

static features are the maximum information gain and
the importance given by a random forest classifier
trained on the dataset.
While there are many sandbox tools that emu-
late the execution of a PE file, nowadays there are Figure 5: Sample running and dynamic feature extraction
malware programs that employ anti-emulation tech- system
niques. Considering that, we decided to run the files
on virtual machines with an EDR sensor installed.
The execution of the file produces a sequence of As displayed in figure 5, each file is run on a vir-
events that are correlated by the EDR sensor through tual machine for at most 3 minutes, the EDR sensor
various heuristics. These heuristics provide behavior extracts dynamic features, then the virtual machine is
flags representing the dynamic features of a file’s exe- reverted to an earlier snapshot in order to mitigate any
cution. Examples of events and dynamic features ex- damage done by a malware program. Even with 10
tracted by the EDR sensor are found in table 3. virtual machines running samples in parallel, it would
In order to minimize the time required for extract- have taken more than 3 years to extract dynamic fea-
ing dynamic features, we developed a system that tures for all files. Because of that, we selected in
uses multiple virtual machines to run PE files in par- a random uniform manner 13814 files. For 13217
allel. of those we were able to extract dynamic features,
9978 labeled benign and 3239 labeled malicious, thus
maintaining the original ratio.
To clean up the dataset, we performed an analysis
on samples for which we had both static and dynamic
data.

C - set of samples correctly classified by either

the model using static features or the model using
dynamic features

M - set of samples incorrectly classified by both

the model using static features and the model using
dynamic features

Nm,K - set of the K closest neighbors of m from

C based on Hamming Distance

1 γ, ym = yn
∆K (m) = ∑ ·
n∈N d H (m, n) + ε 1 − γ, y m ̸= yn
m,K

Figure 7: Static data PCA

m ∈ M; dH - Hamming Distance; γ = 0.85
ym - label of m; yn - label of n

The results of the ∆K metric are displayed in figure

6.

Figure 8: Dynamic data PCA

Figure 6: Diagram of sample separability

5.2 Training & inference
Based on these statistics, we removed 212 samples The training process was performed separately for the
we found to be possible mislabels. This represents model that uses static features and the model that uses
1.6% of the dataset containing dynamic features and dynamic features. These two neural networks serve
0.00003% of the dataset containing static features. as the building blocks to the final model that makes
In order to visualize the extracted data, we use of transfer learning to better correlate static and
performed a PCA analysis. Figure 7 displays the dynamic features.
analysis of the static data and figure 8 displays the In order to obtain the best results, the values of
analysis of the dynamic data. both static and dynamic features in datasets were nor-
malized such that the standard deviation σ = 1 and the
mean µ = 0.
The neural network using static features was
trained on 30 epochs with a variable learning rate
starting from lr = 0.001 and then decreasing from
epoch 5 by lr = lr · e−0.16 . The loss function used
was binary cross entropy. To measure the model’s
performance we used K-fold cross-validation with 5
folds.

Metric Value
FP Rate 0.368%
TP Rate 86.746%
F1 Score 92.234%
Accuracy 96.346%
Table 4: Performance of model using static features

The neural network using dynamic features was

trained on 30 epochs with a variable learning rate Figure 9: Bayes search graphic
similar to the model using static features. The loss
function used was binary cross entropy. Its perfor-
mance was measured using K-fold cross-validation The neural network that uses both static and
with 5 folds. dynamic features was trained on 25 epochs with a
variable learning rate that decreases starting from
epoch 10. When epoch > 21 and lr < 0.00025 all
Metric Value layers of the network are trained. The loss func-
FP Rate 0.716% tion used was binary cross entropy. To measure the
TP Rate 81.52% model’s performance we used K-fold cross-validation
F1 Score 88.52% with 5 folds.
Accuracy 94.832%
Table 5: Performance of model using dynamic features
Metric Value
FP Rate 0.26%
The final neural network uses both static and dy- TP Rate 97.822%
namic features and it processes them on two different F1 Score 98.47%
branches. Neurons on these branches load weights Accuracy 99.302%
and biases from the previous two models that are al- Table 6: Performance of model using static and dynamic
ready trained, thus making use of transfer learning. At features
first, only neurons processing the concatenated results
from the first two branches are trained, but after a cer-
tain epoch and learning rate, all neurons are trained.
We used this scheme in order to make the model
learn based on knowledge already gained by the pre- 6 CONCLUSIONS
vious two models. In this way, we are able to take full
advantage of the large number of instances with static Based on the results, we can confidently say that the
data while also using the statistically representative model using combined features is best suited for prac-
number of instances with dynamic data. Furthermore, tical application. By having the highest TP rate and
by using this training scheme we were able to reduce the lowest FP rate, the combined model is able to
overfitting and obtain a considerable performance im- raise alerts that offer a high degree of visibility while
provement. keeping alert fatigue at a minimum. This offers a way
In order to find the best combination of hyper- for cyber-security analysts to quickly identify an ad-
parameters, we used a Bayes search algorithm that vanced threat without having to shift through large
tries to minimize a function we chose f (model) = amounts of false positive alerts.
1 − F1Score(model). Figure 9 displays the value of Taking a closer look, we found that the increase in
this function at the number of attempts made by the accuracy was not just comprised of samples correctly
Bayes search algorithm. identified by either the model using just static fea-
tures or the model using dynamic features. The model
using combined features correctly classified samples
that neither of the two previous models did. This pro- jections and neural networks. In 2013 IEEE Inter-
vides a way to counteract advanced attacks better. national Conference on Acoustics, Speech and Signal
We tested each model on the dataset containing Processing, pages 3422–3426.
both static and dynamic features. Ijaz, M., Durad, M. H., and Ismail, M. (2019). Static and
dynamic malware analysis using machine learning. In
2019 16th International Bhurban Conference on Ap-
Let S, D, and C be the sets of samples correctly plied Sciences and Technology (IBCAST), pages 687–
labeled by each model (S for the model using static 691.
data, D for the model using dynamic data and C for Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro,
the model using combined data). B., and Nicholas, C. K. (2017a). Malware detection
by eating a whole exe. In AAAI Workshops.
In table 7 we show how using static and dynamic data Raff, E., Sylvester, J., and Nicholas, C. (2017b). Learn-
contributes to the final model performance. Keep in ing the pe header, malware detection with minimal do-
mind that, as accuracy approaches 100%, even small main knowledge. pages 121–132.
improvements are significant, especially in the field Ronen, R., Radu, M., Feuerstein, C., Yom-Tov, E., and Ah-
of malware detection. madi, M. (2018). Microsoft malware classification
challenge. CoRR, abs/1802.10135.
Element Accuracy Santos, I., Devesa, J., Brezo, F., Nieves, J., and Bringas,
Correctly classified by P. G. (2013). Opem: A static-dynamic approach
S ∩C 98.704% for machine-learning-based malware detection. In
analyzing static data
Herrero, Á., Snášel, V., Abraham, A., Zelinka, I.,
Improvement by analyz-
(D \ S) ∩C 0.6% Baruque, B., Quintián, H., Calvo, J. L., Sedano, J.,
ing dynamic data and Corchado, E., editors, International Joint Confer-
Improvement by correlat- ence CISIS’12-ICEUTE´12-SOCO´12 Special Ses-
ing both static and dy- C \ (S ∪ D) 0.0144% sions, pages 271–280, Berlin, Heidelberg. Springer
namic data Berlin Heidelberg.
Total correctly classified Zhang, S., Wu, J., Zhang, M., and Yang, W. (2023). Dy-
samples by combined C 99.319% namic malware analysis based on api sequence seman-
tic fusion. Applied Sciences, 13:6526.
model
Zhao, Z., Zhao, D., Yang, S., and Xu, L. (2023). Image-
Table 7: Analysis of correctly classified samples by com- based malware classification method with the alexnet
bined model convolutional neural network model. Security and
Communication Networks, 2023:1–15.
One disadvantage our solution currently has is that Zhou, H. (2019). Malware detection with neural network
it was trained using just the initial access stage of an using combined features. In Yun, X., Wen, W., Lang,
attack. While from a protection perspective, this is B., Yan, H., Ding, L., Li, J., and Zhou, Y., editors, Cy-
desired, the EDR philosophy is to provide visibility. ber Security, pages 96–106, Singapore. Springer Sin-
In the next iteration, we plan to train the model using gapore.
events from multiple steps of an attack, from initial
access to exfiltration.

REFERENCES
Aghakhani, H., Gritti, F., Mecca, F., Lindorfer, M., Or-
tolani, S., Balzarotti, D., Vigna, G., and Kruegel, C.
(2020). When malware is packin’ heat; limits of ma-
chine learning classifiers based on static analysis fea-
tures. Proceedings 2020 Network and Distributed Sys-
tem Security Symposium.
Ahmadi, M., Ulyanov, D., Semenov, S., Trofimov, M., and
Giacinto, G. (2016). Novel feature extraction, selec-
tion and fusion for effective malware family classifi-
cation.
Carlin, D., Okane, P., and Sezer, S. (2019). A cost analysis
of machine learning using dynamic runtime opcodes
for malware detection. Computers Security, 85.
Dahl, G. E., Stokes, J. W., Deng, L., and Yu, D. (2013).
Large-scale malware classification using random pro-