A malicious programs detection method incorporating transformer and co-occurrence matrix
Changyi Zhong, Qianyu Yu, Haoxin Luo, Shaohao Xie · 2023
To address the problem that traditional malicious program detection algorithms require a lot of specialized domain knowledge and convolutional neural networks for detecting malicious programs that are difficult to capture global features and long-range dependencies, we propose a malicious program detection method based on Transformer architecture and innovatively use the program assembly opcode frequency to construct a co-occurrence matrix, which in turn generates images as model inputs. Using the multi-headed attention mechanism of Transformer, we extract the malicious program opcode invocation pattern implied behind the co-occurrence matrix image and thus achieve the detection of malicious programs. The method can adapt to PE files of different sizes with fewer parameters and outperforms ViT-B/16 with an accuracy of 0.9887, precision of 0.9873, and F1 score of 0.9849.