# Malware Classification Using Long Short-Term Memory Models

arXiv: https://arxiv.org/abs/2103.02746 · HTML: https://mlsanity.com/paper/2103.02746/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 23 references that are in the map.
- First posted on arXiv 3 Mar 2021.

## Builds on (most cited first, 5 of 5)

- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Long Short-Term Memory-Networks for Machine Reading](https://mlsanity.com/paper/1601.06733/) (2016)
- [Deep Bidirectional and Unidirectional LSTM Recurrent Neural Network for Network-wide Traffic Speed Prediction](https://mlsanity.com/paper/1801.02143/) (2018)
- [Malware Detection with LSTM using Opcode Language](https://mlsanity.com/paper/1906.04593/) (2019)
- [Comparison of Deep Learning and the Classical Machine Learning Algorithm for the Malware Detection](https://mlsanity.com/paper/1809.05889/) (2018)

## Built on by (most cited first, 7 of 7)

- [Prompt Engineering-assisted Malware Dynamic Analysis Using GPT-4](https://mlsanity.com/paper/2312.08317/) (2023)
- [Generative Adversarial Networks and Image-Based Malware Classification](https://mlsanity.com/paper/2207.00421/) (2022)
- [A Natural Language Processing Approach to Malware Classification](https://mlsanity.com/paper/2307.11032/) (2023)
- [Auxiliary-Classifier GAN for Malware Analysis](https://mlsanity.com/paper/2107.01620/) (2021)
- [Ransomware Detection using Process Memory](https://mlsanity.com/paper/2203.16871/) (2022)
- [Fully-fused Multi-Layer Perceptrons on Intel Data Center GPUs](https://mlsanity.com/paper/2403.17607/) (2024)
- [A Structured State Space Sequence Model for Multi-Class Classification of Malware](https://mlsanity.com/paper/2610.01893/) (2026)

## Abstract (arXiv)

Signature and anomaly based techniques are the quintessential approaches to malware detection. However, these techniques have become increasingly ineffective as malware has become more sophisticated and complex. Researchers have therefore turned to deep learning to construct better performing model. In this paper, we create four different long-short term memory (LSTM) based models and train each to classify malware samples from 20 families. Our features consist of opcodes extracted from malware executables. We employ techniques used in natural language processing (NLP), including word embedding and bidirection LSTMs (biLSTM), and we also use convolutional neural networks (CNN). We find that a model consisting of word embedding, biLSTMs, and CNN layers performs best in our malware classification experiments.