A dynamic malware detection method based on multi-modal features

Abstract The rapid increase of sophisticated malware poses significant challenges to existing detection methods. To address the challenge, we propose a dynamic malware detection method based on multi-modal features. This approach utilizes two distinct modalities from in-band and out-of-band: the API (Application Programming Interface) sequence features obtained in sandbox, and the image features converted by memory dump files obtained out of VM (Virtual Machine). A multi-modal deep learning model is proposed to fuse these features to distinguish sophisticated malware. Experiments show that our method is effective, achieving 98.6% accuracy on a dataset collected from VirusTotal and CNET. It demonstrates significant improvements over single-modal methods using either text or image features alone, while combining the advantages of out-of-band and in-band dynamic detection, providing an effective solution for malware detection.