# A Survey of the Recent Trends in Deep Learning Based Malware Detection
## 2 Trends in Malware Detection
### Shortcomings of Primitive Methods (Statistical Analysis Based Methods) for Detecting Malware  
Primitive methods of malware analysis depend upon statistical analysis of changes in the system or probabilistic explanation of an executable being malware based on the appearance of literals. But this probabilistic or statistical approach gives approximation over only a few features of malware and even gets stuck with obfuscated malware.  
Packed executables were ignored by [21] and even the dataset was small which led to the uncertainty of results if the implemented solution is deployed in real-time. Ref. [19] made use of a detection algorithm that is context insensitive and is unable to track the calling context of the executable.  
Another framework that was mentioned by [25] made use of windows audit logs but since windows audit logs can be obfuscated then in such case the presented solution is of no use. Secondly, researchers in [25] run the experiments for only 4 min which could have easily ignored the slow executing malware.  
The solution given by [24] did not consider all those features which play an important role in the detection of malware.  
The solution modeled by [22] used low interactive honeypots which allow only limited interaction of malware; thus, some malware can get undetected and get active only on the occurrence of certain conditions.  
In the work done by [20], FPR is too high to implement the system in a real environment. The solution given by [67] tried to cater to metamorphism but dealt with only 3 techniques of obfuscation whereas there are many more techniques to obfuscate due to which claimed results cannot be reproduced in a real environment.  
Hence, papers surveyed proposing the solutions for malware detection based on heuristic and statistical approaches, show that there is a need of adopting other techniques. Those techniques should be capable of improving FPR to generate a robust and reliable solution that can be implemented in real-time.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Title** & **Author** & **Year** & **Weakness/Limitation** \\ \hline Deep Learning for Classification & & & The approach did not consider the evasion of malware detectors by inserting noise in system calls. Moreover, work depends on system calls’ paths which depend on input data. \\ \hline Malware Detection with Deep & & & Due to the small amount of data, large Deep Neural Networks are not used. \\ Neural Network Using Process & & & Malware are transformed into fixed-size images but can be converted to variable size to get good model learning. \\ Behavior & & & \\ \hline Robust Intelligent Malware & & & Malware are transformed into fixed-size images but can be converted to variable size to get good model learning. \\ Detection Using Deep Learning & & & \\ \hline Deep Neural Network-Based & & & \\ Malware Detection Using Two & & & A small amount of data is used for getting low false positives, moreover only syntactic features are used, and semantic features are not focused. \\ Dimensional Binary Program & & [PERSON], [PERSON], & In one of the baseline approaches, features were not normalized \\ Detection With Minimal Domain & & [PERSON] & 2017 \\ Knowledge & & & \\ \hline One-Shot Learning Approach for & & [PERSON], [PERSON], [PERSON] & 2018 \\ Unknown Malware Classification & & [PERSON] & \\ \hline Windows PE Malware Detection & & & \\ Using Ensemble Learning & & & \\ \hline Ensemble-Based Classification & & & \\ Using Neural Networks and & & & \\ Machine Learning Models for & & & \\ Windows PE Malware Detection & & & \\ \hline \hline \end{tabular}
\end{table}
Table 6: \(Cont.\)