# Task-Aware Meta Learning-based Siamese Neural Network for Classifying Obfuscated Malware

arXiv: https://arxiv.org/abs/2110.13409 · HTML: https://mlsanity.com/paper/2110.13409/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 61 references that are in the map.
- First posted on arXiv 26 Oct 2021.

## Builds on (most cited first, 7 of 7)

- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Prototypical Networks for Few-shot Learning](https://mlsanity.com/paper/1703.05175/) (2017)
- [Matching Networks for One Shot Learning](https://mlsanity.com/paper/1606.04080/) (2016)
- [Dynamic Few-Shot Visual Learning without Forgetting](https://mlsanity.com/paper/1804.09458/) (2018)
- [Lightweight Classification of IoT Malware based on Image Recognition](https://mlsanity.com/paper/1802.03714/) (2018)
- [Joint Dictionaries for Zero-Shot Learning](https://mlsanity.com/paper/1709.03688/) (2017)
- [Adaptive Decision Making via Entropy Minimization](https://mlsanity.com/paper/1803.06638/) (2018)

## Built on by (most cited first, 1 of 1)

- [A Game-Theoretic Approach for AI-based Botnet Attack Defence](https://mlsanity.com/paper/2112.02223/) (2021)

## Abstract (arXiv)

Malware authors apply different techniques of control flow obfuscation, in order to create new malware variants to avoid detection. Existing Siamese neural network (SNN)-based malware detection methods fail to correctly classify different malware families when such obfuscated malware samples are present in the training dataset, resulting in high false-positive rates. To address this issue, we propose a novel task-aware few-shot-learning-based Siamese Neural Network that is resilient against the presence of malware variants affected by such control flow obfuscation techniques. Using the average entropy features of each malware family as inputs, in addition to the image features, our model generates the parameters for the feature layers, to more accurately adjust the feature embedding for different malware families, each of which has obfuscated malware variants. In addition, our proposed method can classify malware classes, even if there are only one or a few training samples available. Our model utilizes few-shot learning with the extracted features of a pre-trained network (e.g., VGG-16), to avoid the bias typically associated with a model trained with a limited number of training samples. Our proposed approach is highly effective in recognizing unique malware signatures, thus correctly classifying malware samples that belong to the same malware family, even in the presence of obfuscated malware variants. Our experimental results, validated by N-way on N-shot learning, show that our model is highly effective in classification accuracy, exceeding a rate textgreater 91%, compared to other similar methods.