Malware Detection in Forensic Memory Dumps: The Use of Deep Meta-Learning Models

Authors : Yalçın Özkan

Pages : 165-172

Doi:10.26650/acin.1282824

View : 41 | Download : 39

Publication Date : 2024-01-02

Article Type : Research Paper

Abstract :The present study aimed to design a high-performance deep meta-learning model that could be utilized in classification predictions using forensic memory datasets and propose a framework that would ensure the generalization and consistency of the predictions with the help of this model. To achieve this aim, a dataset containing malware and obtained from forensic memory dumps was addressed. First, it was subjected to the classification process with a deep learning algorithm, and a predictive model was acquired. The predictive model was found to have an accuracy metric of 98.25%. In addition to this finding, a meta-learning model consisting of five different models with the same hyperparameters was created. The accuracy of the obtained meta-model was computed as 97.69%. With the thought that this model would reduce the prediction variance and thus the predictive model could be generalized, it was ensured to be run 5 times in a row. As a result of this process, the prediction variance, indicating a very small change, was calculated as 0.000012. Accordingly, considering the acquired performance value, it can be determined that high performance is achieved in malware detection, and thus what hyperparameters ensure success can be revealed. If deep learning methods are used as a single model, the problem is that the variance between the predictions is large due to its stochastic structure. To avoid such drawbacks, a deep meta-learning model using the same parameters was designed instead of a deep learning model comprising a single model, and considerably smaller variance values were achieved, thus providing generalized and consistent predictions.
Keywords : Adli bellek, Siber güvenlik, Derin öğrenme, Meta öğrenme