# A Survey of the Recent Trends in Deep Learning Based Malware Detection
## 2 Trends in Malware Detection
### Malware Detection with Deep Learning Based Methods
\begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**Title**} & \multirow{2}{*}{**Author**} & \multirow{2}{*}{**Year**} & \multicolumn{4}{c}{**Dataset Samples**} & \multicolumn{2}{c}{**Performance Metrics**} \\ \cline{5-7}  & & & **Source** & **Malicious** & **Benign** & \\ \hline Robust Malware & Azmood-eh, & & & & & \\ Detection for the & [PERSON], [PERSON] & & & & & \\ Internet of & Dehghanata- & 2018 & VirusTotal & 1078 & 128 & Accuracy = 99\% \\ (Battlefield) Things & & & & & Recall = 98\% \\ Devices Using Deep & & & & & \\ Eigenspace Learning & [PERSON]. & & & & \\ \hline Detection of & & & & & \\ Malicious Code & [PERSON], [PERSON], & 2018 & Vision Research Lab & 9342 (25 Malware & - & \begin{tabular}{l} Accuracy = 94.5 \\ Precision = 94.6 \\ Recall = 94.5 \\ Runtime = 20 ms \\ \end{tabular} \\ Variants Based on & & & & & \\ Deep Learning & & & & & \\ \hline Malware & [PERSON], [PERSON], & & & \\ Identification Using & & & & \\ visualization images & and Rei & & & \\ and deep learning & & & & \\ \hline End-to-End Deep & & & & \\ Neural Networks & [PERSON], & & & \\ and Transfer & [PERSON], & & & \\ Learning for & [PERSON] & 2018 & Cuckoo Sandbox & 3200 (2 APT classes) & - & Accuracy = 98.6\% \\ Automatic Analysis & & & & & \\ of Nation State & [PERSON]. & & & & \\ Malware & & & & & \\ \hline Empowering & & & & & \\ Convolutional & & & & & \\ Networks for & [PERSON], & 2017 & [PERSON], Maltrireve, Private & - & - & \begin{tabular}{l} Precision = 0.93 \\ Recall = 0.93 \\ F-1 Score = 0.92 \\ \end{tabular} \\ Malware & & [PERSON], et al. & 2017 & Collection & - & - & \
\begin{tabular}{l} Precision = 0.986 \\ Recall = 0.992 \\ F-1 Score = 0.989 \\ \end{tabular} \\ Malware Detection & & & & & & \\ Based on Deep & & & & & \\ Learning of Behavior & & & & \\ Graphs & & & & \\ \hline Deep Learning for & & & & \\ Classification of & & & & \\ Malware System Call & & & & \\ Sequences & & & & \\ \hline Malware Detection & & & & \\ with Deep Neural & & & & \\ Network Using & & & & \\ Process Behavior & & & & \\ \hline  & & & & \\ Robust Intelligent & [PERSON] & 2018 & & & \\ Malware Detection & [PERSON] et al. & 2018 & & & \\ Using Deep Learning & & & & \\ \hline  & & & & \\  & & & & \\  & & & & \\  & & & & \\ \end{tabular}
\begin{tabular}{l} Accuracy = 98.9\% \\ Precision = 99.7\% \\ Recall = 98.1\% \\ F-1 score = 98.9\% \\ \end{tabular} \\ \hline Deep Neural & & & & & & \\ Network Based & & & & & \\ Malware Detection & & & & \\ Using Two & & & & \\ Dimensional Binary & & & & \\ Program Features & & & \\ \hline  & & & & \\ \end{tabular}
\end{table} 
Table 3: _Cont._Ref. [63] have explored the Siamese network for malware image classification. Siamese network architecture is the application of one shot learning field. The basic approach used by [63] was to transform the features into malware images that were input to Siamese Convolutional Neural Networks shown in Figure 8. Siamese CNNs used by the [63] produce 2 feature vectors. Finally, the Manhattan distance between those feature vectors was calculated and given to the sigmoid function to generate the similarity score. Another surveyed paper [57] mentioned the use of one shot learning approach with a memory augmented neural network using the API calls sequence. Ref. [57] adapted an approach that has two domains of learning. The first domain in this approach is used to train the model with known malware and 2 nd domain is used to train or test with a dataset of an unknown type of malware. Domain 2 makes use of domain 1's trained model. The working of the implemented approach [57] is shown in Figure 9.  
Ref. [64] have explored one shot learning approach with matching and prototypical networks. The developed model by [64] is shown in Figure 10. Ref. [64] take advantage of visual dissimilarity in the images of different malware families (shown in Figure 11) and have converted the malware binaries into 8-bit greyscale images to be given as input to the few shot learning models. Ref. [65] presents a few shot learning based neural network ConvProtoNet.