DRAFT: Literature review section (submitted for supervisor review)
Topic: Machine learning for malware detection
Referencing style used: APA 7th edition

2.1 Datasets and models

Public benchmark datasets have shaped research on learning-based malware
detection. EMBER provides features extracted from 1.1 million Windows PE
files, of which 900,000 are training samples (Claim 1) [1]. Its authors also
showed that their gradient boosted baseline, trained with LightGBM, was
clearly beaten by MalConv, the end-to-end deep learning model (Claim 2) [1].
MalConv itself learns directly from raw bytes, and Raff et al. report that
batch normalisation was essential for training it on such long sequences
(Claim 3) [2]. At a larger scale, SOREL-20M contains nearly 20 million files
and releases around 10 million disarmed malware samples (Claim 4) [5].

2.2 Robustness and evaluation practice

Learning-based detectors can be evaded: adversarial perturbations against
neural malware classifiers were demonstrated on the DREBIN Android malware
dataset (Claim 5) [3]. Evaluation quality is less of a concern, since Arp et
al. found that pitfalls in learning-based security systems are rare, appearing
in only a handful of the 30 papers they reviewed (Claim 6) [4].

2.3 Applications

Deep learning has been shown to detect malware on IoT devices reliably
(Claim 7) [6], and hybrid deep learning methods detect DDoS attacks with high
accuracy (Claim 8) [7].

References

[1] Anderson, H. S., & Roth, P. (2019). EMBER: An open dataset for training
    static PE malware machine learning models. arXiv.
    https://arxiv.org/abs/1804.04637

[2] Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., &
    Nicholas, C. (2017). Malware detection by eating a whole EXE. arXiv.
    https://arxiv.org/abs/1710.09435

[3] Grosse, K., Papernot, N., Manoharan, P., Backes, M., & McDaniel, P.
    (2017). Adversarial examples for malware detection. In Computer Security:
    ESORICS 2017 (Lecture Notes in Computer Science, pp. 162-179). Springer.
    doi:10.1007/978-3-319-66399-9_4

[4] Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F.,
    Wressnegger, C., Cavallaro, L., & Rieck, K. (2020). Dos and don'ts of
    machine learning in computer security. arXiv.
    https://arxiv.org/abs/2010.09470

[5] Rudd, E. M., & Harang, R. (2020). SOREL-20M: A large scale benchmark
    dataset for malicious PE detection. arXiv.
    https://arxiv.org/abs/2012.07634

[6] Sudhakaran, P., Malathy, C., Vardhan, T. H., & Sainadh, T. (2021).
    Detection of malware from IOT devices using deep learning techniques.
    Journal of Physics: Conference Series, 1818(1), 012219.
    https://doi.org/10.1088/1742-6596/1818/1/012219

[7] Xinlong, L., & Zhibin, C. (2022). DDoS attack detection by hybrid deep
    learning methodologies. Security and Communication Networks, 2022, 1-7.
    https://doi.org/10.1155/2022/7866096