# Malware Detection with LSTM using Opcode Language

arXiv: https://arxiv.org/abs/1906.04593 · HTML: https://mlsanity.com/paper/1906.04593/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Jun 2019.

## Built on by (most cited first, 6 of 6)

- [Malware Classification Using Long Short-Term Memory Models](https://mlsanity.com/paper/2103.02746/) (2021)
- [A Natural Language Processing Approach to Malware Classification](https://mlsanity.com/paper/2307.11032/) (2023)
- [Malicious Code Detection: Run Trace Output Analysis by LSTM](https://mlsanity.com/paper/2101.05646/) (2021)
- [LSTM Hyper-Parameter Selection for Malware Detection: Interaction Effects and Hierarchical Selection Approach](https://mlsanity.com/paper/2109.11500/) (2021)
- [MATA: Multi-Agent Framework for Reliable and Flexible Table Question Answering](https://mlsanity.com/paper/2602.09642/) (2026)
- [Malware Classification using a Hybrid Hidden Markov Model-Convolutional Neural Network](https://mlsanity.com/paper/2412.18932/) (2024)

## Abstract (arXiv)

Nowadays, with the booming development of Internet and software industry, more and more malware variants are designed to perform various malicious activities. Traditional signature-based detection methods can not detect variants of malware. In addition, most behavior-based methods require a secure and isolated environment to perform malware detection, which is vulnerable to be contaminated. In this paper, similar to natural language processing, we propose a novel and efficient approach to perform static malware analysis, which can automatically learn the opcode sequence patterns of malware. We propose modeling malware as a language and assess the feasibility of this approach. First, We use the disassembly tool IDA Pro to obtain opcode sequence of malware. Then the word embedding technique is used to learn the feature vector representation of opcode. Finally, we propose a two-stage LSTM model for malware detection, which use two LSTM layers and one mean-pooling layer to obtain the feature representations of opcode sequences of malwares. We perform experiments on the dataset that includes 969 malware and 123 benign files. In terms of malware detection and malware classification, the evaluation results show our proposed method can achieve average AUC of 0.99 and average AUC of 0.987 in best case, respectively.