# DeepSign: Deep Learning for Automatic Malware Signature Generation and Classification

arXiv: https://arxiv.org/abs/1711.08336 · HTML: https://mlsanity.com/paper/1711.08336/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Nov 2017.

## Built on by (most cited first, 8 of 8)

- [FENXI: Deep-learning Traffic Analytics at the Edge](https://mlsanity.com/paper/2105.11738/) (2021)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [On Technique Identification and Threat-Actor Attribution using LLMs and Embedding Models](https://mlsanity.com/paper/2505.11547/) (2025)
- [LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach](https://mlsanity.com/paper/2109.11500/) (2021)
- [ARDIR: Improving Robustness using Knowledge Distillation of Internal Representation](https://mlsanity.com/paper/2211.00239/) (2022)
- [A Comparison of State-of-the-Art Techniques for Generating Adversarial Malware Binaries](https://mlsanity.com/paper/2111.11487/) (2021)
- [Enhancing Malware Detection by Integrating Machine Learning with Cuckoo Sandbox](https://mlsanity.com/paper/2311.04372/) (2023)
- [Leveraging LSTM and GAN for Modern Malware Detection](https://mlsanity.com/paper/2405.04373/) (2024)

## Abstract (arXiv)

This paper presents a novel deep learning based method for automatic malware signature generation and classification. The method uses a deep belief network (DBN), implemented with a deep stack of denoising autoencoders, generating an invariant compact representation of the malware behavior. While conventional signature and token based methods for malware detection do not detect a majority of new variants for existing malware, the results presented in this paper show that signatures generated by the DBN allow for an accurate classification of new malware variants. Using a dataset containing hundreds of variants for several major malware families, our method achieves 98.6% classification accuracy using the signatures generated by the DBN. The presented method is completely agnostic to the type of malware behavior that is logged (e.g., API calls and their parameters, registry entries, websites and ports accessed, etc.), and can use any raw input from a sandbox to successfully train the deep neural network which is used to generate malware signatures.