Malware Classification through Opcodes using Deep Learning RNN and CNN models

This research study proposes a novel method for classifying malware using opcode sequences extracted from Windows files. Deep learning models such as RNN, LSTM, GRU, and a hybrid CNN-LSTM architecture are employed to achieve this. A dataset consisting of 500 malware samples from VirusShare and 500 non malware programs from GitHub was gathered. The collected samples were disassembled using IDA Pro to obtain opcode sequences, which were then processed to capture the execution patterns relevant to malware detection. The RNN, LSTM, GRU, and CNN-LSTM models were trained on these sequences to identify differences between malicious and benign software. Results shown that deep learning models, particularly the CNN-LSTM hybrid, significantly improve classification accuracy. The CNN-LSTM model achieved 98.5% accuracy, surpassing the RNN, LSTM, and GRU models, which recorded accuracies of $95 \%, 96.5 \%$, and $96 \%$, respectively. These findings highlight the potential of deep learning, especially CNN-LSTM, as an effective and scalable approach for detecting evolving malware threat.