Hybrid Malware Detection using BERT and Random Forest

Malware detection is a critical aspect of cybersecurity. Hence there is an utmost need to protect against new emerging threats in the most efficient and accurate ways possible. In this research work, Application Programming Interface (API) call sequences are employed for malware identification purposes by leveraging a hybrid approach involving Bidirectional Encoder Representations from Transformers (BERT) and Random Forest (RF). The BERT is a transformer-based model to derive contextual embeddings from API call sequences, representing the complex relations that exist in the data. These embeddings were then used as the input to the Random Forest classifier that was robust and efficient to classify samples as malware and benign. The data comprised 3,940 samples, of which 2,626 were malware, and the remaining 1,314 were benign. The proposed BERT + RF model resulted in a highly accurate result of 95.30%.