{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/classification-of-malware-by-using-structural","title":"Classification of Malware by Using Structural Entropy on Convolutional Neural Networks","arxiv_id":null,"date":"2018-04-27","proceeding":null,"authors":["Daniel Gibert","Carles Mateu","Jordi Planes","Ramon Vicens"],"abstract":"he number of malicious programs has grown both in number and in sophistication. Analyzing the malicious intent of\r\nvast amounts of data requires huge resources and thus, effective categorization of malware is required. In this paper,\r\nthe content of a malicious program is represented as an entropy stream, where each value describes the amount of entropy of a small chunk of code in a specific location of the file. Wavelet transforms are then applied to this entropy signal to\r\ndescribe the variation in the entropic energy. Motivated by the visual similarity between streams of entropy of malicious\r\nsoftware belonging to the same family, we propose a file agnostic deep learning approach for categorization of malware.\r\nOur method exploits the fact that most variants are generated by using common obfuscation techniques and that compression and encryption algorithms retain some properties present in the original code. This allows us to find discriminative patterns that almost all variants in a family share. Our method has been evaluated using the data provided by Microsoft for the BigData Innovators Gathering Anti-Malware Prediction Challenge, and achieved promising results in comparison with the State of the Art.","url_abs":"https://www.aaai.org/ocs/index.php/AAAI/AAAI18/paper/view/16133","url_pdf":"https://www.aaai.org/ocs/index.php/AAAI/AAAI18/paper/viewFile/16133/16383","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"classification-of-malware-by-using-structural","repo_url":"https://github.com/danielgibert/mlw_classification_structural_entropy","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"tf","reach":null}],"tasks":[{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"malware-classification","task_name":"Malware Classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Dynamic Time Wrapping + K-NN","rank_in_archive_order":8,"of":29,"metrics":{"Accuracy (10-fold)":"0.9894","LogLoss":"0.367724","Macro F1 (10-fold)":"0.9813"},"uses_additional_data":false},{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Multiresolution CNN","rank_in_archive_order":11,"of":29,"metrics":{"Accuracy (10-fold)":"0.9828","LogLoss":"0.124431","Macro F1 (10-fold)":"0.9636"},"uses_additional_data":false},{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Structural entropy CNN","rank_in_archive_order":18,"of":29,"metrics":{"Accuracy (10-fold)":"0.9708","LogLoss":"0.134624","Macro F1 (10-fold)":"0.9314"},"uses_additional_data":false},{"leaderboard":"/sota/malware-classification-on-microsoft-malware","task":"Malware Classification","dataset":"Microsoft Malware Classification Challenge","model":"Multiresolution CNN + Bagging","rank_in_archive_order":23,"of":29,"metrics":{"LogLoss":"0.075081"},"uses_additional_data":false}],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}