Leveraging Occlusion Sensitivity for Malicious Code Localization

Malware injection attacks represent a significant threat to the security of computer systems and networks, necessitating robust detection and mitigation strategies. This paper investigates the efficacy of convolutional neural networks (CNNs) in detecting malicious files, employing a novel approach that utilizes occlusion sensitivity analysis. By converting Portable Executable (PE) files into image representations through N-Gram Pixel Mapping, we assess the ability of CNNs to accurately classify malicious code segments. Our methodology includes a comprehensive evaluation of a dataset sourced from MalwareBazaar, comprising over 1,000 malware-infected files across various families. The results reveal that while CNN models such as MalConv demonstrate resilience and improved recall after occlusion analysis, other models like PE-Classifier and DeepMalware exhibit performance declines, indicating their sensitivity to feature occlusion. These findings underscore the importance of advanced machine learning techniques in enhancing malware detection accuracy, particularly in recognizing zero-day threats and obscured malicious code. The paper contributes to the ongoing discourse on malware detection, offering insights into effective strategies for improving cybersecurity through AI-driven methodologies.