# A Survey of the Recent Trends in Deep Learning Based Malware Detection
## 2 Trends in Malware Detection
### Malware Detection with Deep Learning Based Methods
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Title** & **Author** & **Year** & **Weakness/Limitation** \\ \hline Improving the detection of malware behavior using simplified data dependent API call graph & [PERSON], [PERSON], [PERSON] & 2015 & One of the major limitations of this research work was the small dataset. \\ \hline Dynamic VSA: a framework for malware detection based on register contents & [PERSON], [PERSON], [PERSON] & 2015 & The authors of this paper used a small dataset which means there is a great chance that models were not trained well. Secondly, a subset of features was used which means there might be many more useful features that were ignored while training. \\ \hline Novel feature extraction, selection, and fusion for effective malware family classification & [PERSON], [PERSON], [PERSON], [PERSON], [PERSON] & 2015 & Feature optimization ignored real distribution \\ \hline Probabilistic inference on integrity for access behavior based malware detection & [PERSON], [PERSON], [PERSON], [PERSON] & 2015 & This research work was carried out on a small dataset, and evasion techniques were not even taken care of, due to which reliability is compromised. Some of the malware need human interaction to get activated as they get triggered over certain input. This important fact was even ignored while the feature extraction process. \\ \hline Robust and effective malware detection through quantitative data flow graph metrics & [PERSON], [PERSON], [PERSON] & 2015 & One of the major limitations of this research work was the usage of a small dataset, secondly, since obfuscation was not dealt with while training so in case encountering the obfuscated malware model would not perform well. \\ \hline An alternative to NCD for large sequences, Lempel-Ziv Jaccard distance & [PERSON], [PERSON] & 2017 & Researchers did not consider the obfuscation while training the models, therefore the performance of models would not be good on real time data. \\ \hline Proposing a hmm-based approach to detect metamorphic malware detection based on statistics of assembly instructions using classification algorithms & [PERSON], [PERSON], [PERSON], [PERSON] & 2015 & The authors of this paper used a small dataset, secondly, a subset of features was used which means there might be many more useful features that were ignored while training. \\ \hline A malware similarity testing framework & [PERSON], [PERSON], [PERSON], [PERSON] & 2015 & Once again, this research work has used small, and again a subset of features is used in this work which means the research has ignored many useful features also. \\ \hline A malware similarity testing framework & [PERSON], [PERSON] & 2015 & An extremely small dataset which raises a serious question on the reliability of the model’s training. \\ \hline A behavior-based malware variant classification technique & [PERSON], [PERSON], [PERSON] & 2016 & Small dataset, non-optimized feature set, ignored real distribution \\ \hline Scaling Malware Execution with Sequential Multi Hypothesis Testing & [PERSON], [PERSON] & 2016 & Since this research work ignored evasion techniques and user interaction for triggering malware behavior during feature extraction, therefore model might not perform well on real time data. \\ \hline Automated malware classification based on network behavior & [PERSON], [PERSON] & 2013 & Using small dataset in training machine learning algorithms, compromises the reliability of results. \\ \hline Malware function classification using APIs in initial behavior & [PERSON], [PERSON] & 2015 & The small dataset which has been used in this research work is the main limitation of this paper. \\ \hline Feature selection and extraction for malware classification & [PERSON], [PERSON], [PERSON], [PERSON] & 2015 & Since this research work ignored evasion techniques and user interaction for triggering malware behavior during feature extraction, therefore model might not perform well on real time data. Moreover, a small dataset was used for training which establishes the fact that the models were not well trained. \\ \hline High-fidelity, behavior based automated malware analysis and classification & [PERSON], [PERSON], [PERSON] & 2015 & This research work ignored evasion techniques. \\ \hline Clustering for malware classification & [PERSON], [PERSON], [PERSON], [PERSON], [PERSON] & 2015 & Researchers did not consider the obfuscation while training the models, therefore the performance of models would not be good on real time data. Secondly, a small dataset was used for training the models which is not recommended. \\ \hline \hline \end{tabular}
\end{table}