 ICACT20260232 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Good morning, everyone. My name is Sahil Singh. It is a pleasure to present our research on Evaluating a novel system for curation of a malware dataset using Siamese Networks. |
| ICACT20260232 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
Lets begin by defining the core threat. Malware is any software that
deliberately exploits vulnerabilities in programmable devices to extort
sensitive information, crash critical systems, or gain unauthorised access
to networks and data. |
| ICACT20260232 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
While malware takes many forms, obfuscation remains one of the most persistent evasion tactics. Obfuscation consists of code transformations that make a program more difficult to understand by changing its structure while preserving the original functionalities. Obfuscation prevents attempts to extract, modify, or reverse-engineer source code. Thereby rendering traditional detection methods ineffective. |
| ICACT20260232 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
Current detection methods, such as Static Analysis, examine the binary code without running it. It is fast to use but easily defeated by obfuscation. Dynamic Analysis executes live malware in a sandbox. While effective at detecting obfuscated malware samples, it is, however, computationally expensive and time-consuming. |
| ICACT20260232 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Beyond detection, the cybersecurity field faces a system challenge: reproducibility. Since malware naturally evolves to counter existing defences. Malware sample data patterns change, therefore degrading the detection accuracy of many Machine learning models. Furthermore, the scarcity of reliable public datasets and restrictions placed on many government-backed datasets make it nearly impossible for researchers to faithfully reproduce and verify existing experiments. |
| ICACT20260232 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Therefore, the objectives of this research are. 1 To replicate Hisao et als Siamese Networks behaviour from their paper, 2. To demonstrate an effective, reproducible pipeline for malware curation, and finally, 3 To curate a modern, representative malware dataset. |
| ICACT20260232 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
Our methodology operates as a five-step pipeline. We begin with Data Gathering to retrieve raw malware samples, then move to Data Conversion to prepare them for texture analysis. Once converted, we organise the samples using their aHash values. This structured data feeds into our Model Creation phase, where we implement the Siamese Network architecture proposed by Hsiao et al. Finally, we validate performance using an N-way evaluation, comparing our replicated model directly with the baselines from the original papers. |
| ICACT20260232 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
During the data-gathering stage, we retrieve raw malware samples from the VirusShare repository using their hash values. We then validate these files by querying VirusTotal, which provides detection labels from over 50 antivirus engines. Finally, we extract both the engine name and the assigned label to serve as the input for our voting system |
| ICACT20260232 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
Our voting system uses a weighted scoring mechanism for antivirus labels. Vendors with historically low positive rates are assigned a weight of 3. Crucially, the selection of high-confidence vendors is grounded in performance data from independent bodies, such as AV-Comparatives. Low confidence and or less consistent engine vendors are assigned a baseline weight of 1. |
| ICACT20260232 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
As shown here, industry leaders such as Bitdefender, Kaspersky, ESET, AVAST, and Microsoft carry the maximum weight. |
| ICACT20260232 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
To ensure the integrity of our dataset, we applied a strict validation process. First, we enforced a 50% threshold: any sample that did not receive a malicious verdict from at least half of the vendors was discarded as benign. Crucially, we implemented a fail-safe against vendor bias. Since many antivirus products, such as GData or Emsisoft, rely on the same underlying engines (like Bitdefender), we consolidated these into a single weighted vote to effectively prevent voting inflation. We also completely excluded multi-engine aggregators like Qihoo 360 to ensure that our final consensus score reflected independent verification rather than redundant data. |
| ICACT20260232 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
We then convert the malware samples into 105 x 105 grayscale images. |
| ICACT20260232 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
This transformation is strategic, as literature confirms that malware variants within the same family exhibit similar characteristics. Importantly, this approach is resilient to sobfuscation. Changes to the code structure may confuse a text analyser, but they rarely alter the overall visual pattern of malware samples. |
| ICACT20260232 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
Once converted, we utilise the aHash algorithm. This step is vital since malware from the same family often targets different operating systems. While there are inter-platform differences, the core logical structure remains the same. The ahash algorithm allows us to group visually similar variants, accommodating for minor structural differences while keeping the family clusters intact. |
| ICACT20260232 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
To organise these hashes, we calculate the Hamming distance between them. Through empirical testing, we identified that a threshold of 3 provides the optimal balance. This specific distance allows us to group visually similar malware samples, accommodating for slight variations, while simultaneously minimising our false positive and false negative error rates |
| ICACT20260232 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
The result of this process is a clustered dataset containing 37 families for training and 19 families for testing. It is important to note that the families in the training set do not overlap with the families in the testing set. |
| ICACT20260232 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
Moving on to Model Creation, we focused solely on replicating the architecture presented by Hisao et al. as documented in their specifications. We implemented a Siamese Network, which is the industry standard for One-Shot learning tasks. Instead of classifying a single image directly, this network takes two inputs and measures the distance or similarity between them. If the distance is below a certain threshold, the model confirms they belong to the same malware class. This allows us to apply powerful image classification techniques directly to our visualised malware samples. |
| ICACT20260232 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
To ensure our results were statistically robust, we didnt run the test once. We used 5 different random seeds to shuffle the data and ran 150 iterations for each N-way value. We then averaged these results to eliminate outliers. To explain the evaluation itself: In a 5-way test, we show the model a Support Set of 5 images from different malware families and a single Query image. The Query belongs to the same family as one of the Support images, but it is a different sample. The model is tested on its ability to look at the Query and correctly identify which Support image it matches. |
| ICACT20260232 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
As seen in the figure above, we do not observe identical numerical values, as expected given the complexity of modern malware compared to the original dataset. The replicated model follows the general behaviour of the original model. |
| ICACT20260232 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
As shown in the graph on the left, our model exhibits a similar performance degradation trend to that of the original study, a relationship supported by a strong positive Pearson correlation. While a t-test indicates a statistically significant difference in the raw numbers, the Mean Absolute Percentage Error is limited to 6.4%. This low margin of error suggests that our pipeline has effectively captured the core characteristics of the original model, a notable outcome given the challenges posed by the unavailability of the original dataset. |
| ICACT20260232 Slide.21
[Big Slide]
|
Chrome Click!! |
 |
To summarise, this study successfully replicated the architecture and behaviour trends reported by Hisao et al. without the original data. We contributed a modern malware dataset, built an automated labelling system to handle it, and statistically validated the performance of our model against the original.
|
| ICACT20260232 Slide.22
[Big Slide]
|
Chrome Click!! |
 |
Thank you for your time and attention today. We would be happy to answer any questions you may have. |
