Research

At UC, I was able to do a Bachelor’s and a Master’s of Science in Computer Engineering. For the thesis, did research on using neural networks for malware detection. I found that I absolutely love research - it is some of the most rewarding work I have ever done.

Detecting Malware Code as Video With Compressed, Time-Distributed Neural Networks

IEEE Access

This, by far, is the paper I’m most excited about from my time at UC. Being published in an open access journal with a good impact factor, I am optimistic the paper might get some good traction. It’s available here.

While in retrospect it could use a more exciting name, the journal article summarizes the main highlights of my research. The concept of Malware as Video, the best networks that we were able to build, comparisons to seminal works, and Node-Distance Pruning. Our results out-preform all works that we were able to find while staying lean and extraordinarily practical.

In addition, out of my work, I believe Node-Distance Pruning may actually be one of the more important things I’ve done. I found it to be a highly effective algorithm and may shed new light on where to go with pruning neural networks. As a future project I would like to submit a PR to get Node-Dist integrated into a more popular neural network library.

Overall, the paper is incredibly gratifying. It feels beyond exciting that the culmination of my work out is there, in a format for others to read and hopefully build on. So many iterations and so much work went into this final paper and I am glad it was able to be published.

Neural Classification of Malware-As-Video with Considerations for In-Hardware Inferencing

M.S. Thesis

If you’re interested in my work I highly recommend downloading my M.S. thesis, available for free here. It’s the most complete and organized work I’ve written both in terms of my research and in terms of, well, everything I’ve ever done. The other papers I’ve written were cut out of the context of the broader picture and therefore, in my opinion, provide value but leave a lot of unanswered questions. Even if there is only one section that interests you, I’d recommend going straight to it and treating the other sections as possible answers to other questions that come up.

I thoroughly enjoyed the process of assembling the work for, and writing, a thesis!

A Foray Into Extracting Malicious Features from Executable Code with Neural Network Salience

NAECON 2019

Chronologically, the work that this paper came from happened last in my time at UC, though it ended up being published sooner due to long review times on the other papers. It is available here.

I love this paper. It’s highly interesting and offers a ton of future work possibilities. Essentially, with saliency, we can see what the networks found to be unique to malware or benign code. This is a fruitful result - what were the commands that were unique to malware or benign code? Can we use these code clusters for a different, faster classification method and cut out the networks altogether? How would saliency differ from Malware as Image methods as compared to Malware as Video?

This short paper, in my mind, raises many interesting questions. It was a great, short project to wrap up my research with at UC as it leaves the door open for future work. There is still so much left to uncover with neural networks and I’m excited to see what the future brings.

Detecting Malicious Assembly using Convolutional, Recurrent Neural Networks

ASTESJ

ASTESJ invited us to write a paper extending our work done in the NAECON 2017 paper, which was our first neural network attempt. I’d like to discuss the journal itself. If one searches ASTESJ they will find some accusations of misconduct/unethical publishing, which was worrisome for me especially as someone young in their career. After consideration, we decided to write a paper on the recurrent neural networks we attempted to use for malware detection, which is available here for free.

There are not many papers using recurrent neural networks in this way - our (my) intention was not to get an easy publish, but to contribute some information that would not go into other papers we submit and be otherwise assumed knowledge without justification. I’ve been apprehensive about the journal, however, all my interactions with the journal were professional, the other papers in the journal seem credible, and others vouch for the integrity of the journal. Therefore, my conclusion at the moment is that the journal is simply young and still growing.

In my eyes, the work should speak for itself, regardless of the journal it appears in. This paper was important for establishing that while recurrent neural networks can work for this solution, they are not at all necessary or optimal. I’m happy with how the paper came out!

Detecting Malicious Assembly with Deep Learning

NAECON 2018

Work began for my research by replicating the results of others with a simple approach, and the first paper we wrote based on that work was presented at NAECON in 2017. The paper is available here.

There are honestly a multitude of things I would change about that first paper. If I could rewrite it, I would tie in more sources, better present the results of the paper as the figures are lacking, more thoroughly test the networks in various ways, and re-word large portions of it for clarity. At the same time, everyone starts somewhere and I’m glad to have been able to write that conference paper at all. I learned much from this paper and believe that the results of that learning can be seen in the works above.