SAGEGAN: Style-Based Anomaly Detection with Gaussian Embeddings using Generative Adversarial Networks
SAGEGAN detects malware by reconstructing portable-executable images with GANs trained only on benign files.
SAGEGAN converts portable executables into three-channel images using Hilbert-mapped bytes, byte-transition surprise, and entropy deviation, then models benign structure with a style-conditioned adversarial generator. A Gaussian style prior and layer-wise style tensors support anomaly ranking and post hoc family analysis. On a corpus covering malware from 214 families, the Gaussian variant reached 89.76% AUC and 88.19% balanced accuracy. The same checkpoints were evaluated without refitting on DIKE, Microsoft BIG 2015, and Lester subsets.
- Benign-only GAN anomaly detector for portable executable files.
- Images encode bytes, transition surprise, and entropy deviation.
- Gaussian variant reached 89.76% AUC and 88.19% balanced accuracy.
- Tested on 214 families plus DIKE, BIG 2015, and Lester.
From the original article
1 min read at arxiv.orgMalware evolves faster than rule-based and signature-driven detection pipelines. This paper presents SAGEGAN, a benign-only trained malware anomaly detection framework that converts portable executable files into compact three-channel images and models benign structure through style-conditioned adversarial reconstruction.
By Thesath Wijayasiri · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.