Malware Detection with AI: A Comprehensive Review of Trends and Challenges with Future Directions
摘要
Detection of malware is an important problem to be addressed in the realm of computer and network security. Malware writers are becoming increasingly competent at creating new versions of malware at a lightning-fast speed using various kinds of obfuscation mechanisms. These new generation malware are so complex that a straightforward simplistic method like the one based on malware signatures can no longer be used for detecting them. Therefore, we need heuristics-based methods that use machine learning and deep learning techniques for learning what features in a file make it malicious or benign. The ML/DL algorithms can do this because they are trained on a huge amount of data. These techniques can further be categorized as static and dynamic malware detection techniques. In this article, we have briefly explored basic malware concepts, various types of malware, malware evasion mechanisms and existing popular malware datasets used in malware detection research. Then we discuss at length, the various types of malware detection approaches using machine learning as well as deep learning by organizing the methods into eight ’novel’ categories based on the kind of input features the methods operate upon. Such a categorization has not been done previously to the best of our knowledge. The discussion also includes a critical analysis of the various methods under each category including insights obtained by cross comparison, strengths/weaknesses of each method as well as the various limitations and challenges. The article also includes current challenges in malware detection like code obfuscation, adversarial attacks, real-time detection, concept drift and evolving malware, explainability and trust in ML/DL models and various areas for futuristic research endeavors like anomaly detection based malware detection, enhancing adversarial robustness of the models, employing attention mechanisms, explainable malware detection, detection of hibernating malware.