ExplainabilitySecuritySafetycs.CR
A Survey of Malware Detection Using Deep Learning
Ahmed Bensaoud, Jugal Kalita, Mahmoud Bensaoud
July 27, 2024
arXiv.org
149 citations
8 influential
Key Takeaways
-
Deep learning models for malware detection lack transparency: The paper identifies a critical gap in current approaches—deep learning classifiers cannot adequately explain their decisions to developers. This "black box" problem means security teams may not understand why a system flagged something as malware, highlighting the need for Explainable AI (XAI) and Interpretable Machine Learning (IML) tools in cybersecurity applications.
-
Adversarial attacks pose a significant threat to malware detection systems: The survey emphasizes that malware detection models are vulnerable to adversarial attacks that can degrade their performance on new, unseen malware variants. This means security systems trained on known threats may fail against slightly modified versions, requiring ongoing model robustness testing.
-
No universal standard benchmarks exist for evaluating malware detection: Unlike other AI applications, the malware detection field lacks standardized datasets for testing, making it difficult to fairly compare different deep learning approaches. This fragmentation means organizations cannot easily determine which detection method is genuinely most effective.
-
Multi-platform malware requires different detection approaches: The paper examines malware detection across Windows, macOS, Linux, iOS, and Android, suggesting that a one-size-fits-all deep learning solution is unrealistic. Security strategies must be tailored to specific operating systems and their unique vulnerabilities.
-
Current deep learning models need rigorous real-world testing: The survey calls for more comprehensive evaluation of state-of-the-art models across diverse malware datasets, indicating that existing research may not adequately reflect how these systems perform against actual threats in production environments.