Boosting GAN Performance: Feature Transformation for Heavy-Tailed Malware Data Generation
摘要
GANs’ ability to learn data distributions and generate realistic samples makes them potentially useful in addressing data imbalance in malware detection systems. Still, a challenge has emerged to their adoption: traditional GANs work best when the input data follows a multi-normal distribution, while malware behavioral features often exhibit a heavy-tailed distribution. Recent literature recognizes that only GANs specifically designed to generate realistic malware behavior samples can successfully train ML-based malware detectors, and several GAN variants have been proposed - with mixed results - to overcome the limitations of traditional ones. In this work, we follow a different approach, introducing feature transformation techniques to Gaussianize the distribution of malware behavioral data. While some studies on financial and industrial process data have attempted to use similar feature transformations, we claim that this is the first time they are applied to data representing malware behavior. We focus on a standard Wasserstein distance-based GAN with gradient penalty (WGAN-GP), and train four variants of it, comparing their performance on raw and transformed malware behavioral data. The results consistently show that feature transformations can boost GANs’ performance as generators of training data. Classifiers trained on GAN-generated data that learned the distribution of inputs after feature transformation gain approximately 0.4% in the F1 score in both binary and multiclass classification scenarios.