Malicious software is a pernicious global problem. A novel multi-task
learning framework is proposed in this paper for malware image classification
for accurate and fast malware detection. We generate bitmap (BMP) and (PNG)
images from malware features, which we feed to a deep learning classifier. Our
state-of-the-art multi-task learning approach has been tested on a new dataset,
for which we have collected approximately 100,000 benign and malicious PE, APK,
Mach-o, and ELF examples. Experiments with seven tasks tested with 4 activation
functions, ReLU, LeakyReLU, PReLU, and ELU separately demonstrate that PReLU
gives the highest accuracy of more than 99.87% on all tasks. Our model can
effectively detect a variety of obfuscation methods like packing, encryption,
and instruction overlapping, strengthing the beneficial claims of our model, in
addition to achieving the state-of-art methods in terms of accuracy.

一种新的多任务学习框架用于恶意软件图像分类，以实现准确快速的恶意软件检测，并通过与其他激活函数的实验结果表明，其在各个任务上的准确度高于 99.87％，能够有效检测隐藏技术并在准确性方面达到最新方法的水平。

深度多任务学习用于恶意软件图像分类

Deep Multi-Task Learning for Malware Image Classification

Machine learning (ML) plays a pivotal role in detecting malicious software.
Despite the high F1-scores reported in numerous studies reaching upwards of
0.99, the issue is not completely solved. Malware detectors often experience
performance decay due to constantly evolving operating systems and attack
methods, which can render previously learned knowledge insufficient for
accurate decision-making on new inputs. This paper argues that commonly
reported results are inflated due to two pervasive sources of experimental bias
in the detection task: spatial bias caused by data distributions that are not
representative of a real-world deployment; and temporal bias caused by
incorrect time splits of data, leading to unrealistic configurations. To
address these biases, we introduce a set of constraints for fair experiment
design, and propose a new metric, AUT, for classifier robustness in real-world
settings. We additionally propose an algorithm designed to tune training data
to enhance classifier performance. Finally, we present TESSERACT, an
open-source framework for realistic classifier comparison. Our evaluation
encompasses both traditional ML and deep learning methods, examining published
works on an extensive Android dataset with 259,230 samples over a five-year
span. Additionally, we conduct case studies in the Windows PE and PDF domains.
Our findings identify the existence of biases in previous studies and reveal
that significant performance enhancements are possible through appropriate,
periodic tuning. We explore how mitigation strategies may support in achieving
a more stable and better performance over time by employing multiple strategies
to delay performance decay.

本论文通过引入公平实验设计的一组约束条件和 AUT 度量，提出了解决恶意软件检测任务中实验偏差的方法，并提供了一个能够增强分类器性能的算法，以及一个用于实际分类器比较的开源框架 TESSERACT。研究发现以前的研究存在偏差，并通过适时调整的多种策略来延缓性能下降，从而实现更稳定和更好的性能。

TESSERACT: 消除恶意软件分类中的实验偏见 —— 跨时空的研究（扩展版）

TESSERACT: Eliminating Experimental Bias in Malware Classification  across Space and Time (Extended Version)

In a context of malicious software detection, machine learning (ML) is widely
used to generalize to new malware. However, it has been demonstrated that ML
models can be fooled or may have generalization problems on malware that has
never been seen. We investigate the possible benefits of quantum algorithms for
classification tasks. We implement two models of Quantum Machine Learning
algorithms, and we compare them to classical models for the classification of a
dataset composed of malicious and benign executable files. We try to optimize
our algorithms based on methods found in the literature, and analyze our
results in an exploratory way, to identify the most interesting directions to
explore for the future.

研究在恶意软件检测方面，通过使用量子算法相比于传统的机器学习算法，对于区分恶意和良性的可执行文件的分类任务所带来的好处，且发现最有趣的未来方向。