Assessing Modality Selection Heuristics to Improve Multimodal Deep Learning for Malware Detection

Abstract

With the growing use of Android devices, security threats are also increasing. While there are some existing malware detection methods, cybercriminals continue to develop ways to evade these security mechanisms. Thus, malware detection systems also need to evolve to meet this challenge. This work is a step towards achieving that goal. Malware detection methods need as much information as possible about the potential malware, and a multimodal approach can help in this regard by combining different aspects of an Android application. Using multimodal deep learning, it is possible to automatically learn a hierarchical representation for each modality and to give more weights to the more reliable modalities. Multiple modalities can improve classification by providing complementary information, however, the use of all available modalities does not necessarily maximize performance. Multimodal machine learning could benefit from a mechanism to guide the selection of modalities to include in a multimodal model. This work uses a malware detection problem to compare multiple heuristics for this selection process. We have used three different heuristics approaches for selecting the modalities at each step - the maxDifference heuristic, the maxSimilarity heuristic, and the maxAccuracy heuristic. Our experiments show that selecting modalities with low predictive correlation works better than the other examined heuristics. Our result suggest we do not need to combine highly accurate unimodal models, but rather we need models that make different kinds of errors. This method is designed to improve the stability and accuracy of our malware detection algorithms while reducing the overall cost.