{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T19:35:05Z","timestamp":1777059305178,"version":"3.51.4"},"reference-count":37,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2020,1,17]],"date-time":"2020-01-17T00:00:00Z","timestamp":1579219200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>The ability to stop malware as soon as they start spreading will always play an important role in defending computer systems. It must be a huge benefit for organizations as well as society if intelligent defense systems could themselves detect and prevent new types of malware as soon as they reveal only a tiny amount of samples. An approach introduced in this paper takes advantage of One-shot\/Few-shot learning algorithms to solve the malware classification problems using a Memory Augmented Neural Network in combination with the Natural Language Processing techniques such as word2vec, n-gram. We embed the malware\u2019s API calls, which are very valuable sources of information for identifying malware\u2019s behaviors, in the different feature spaces, and then feed them to the one-shot\/few-shot learning models. Evaluating the model on the two datasets (FFRI 2017 and APIMDS) shows that the models with different parameters could yield high accuracy on malware classification with only a few samples. For example, on the APIMDS dataset, it was able to guess 78.85% correctly after seeing only nine malware samples and 89.59% after fine-tuning with a few other samples. The results confirmed very good accuracies compared to the other traditional methods, and point to a new area of malware research.<\/jats:p>","DOI":"10.3390\/info11010051","type":"journal-article","created":{"date-parts":[[2020,1,17]],"date-time":"2020-01-17T07:39:02Z","timestamp":1579246742000},"page":"51","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":19,"title":["MANNWARE: A Malware Classification Approach with a Few Samples Using a Memory Augmented Neural Network"],"prefix":"10.3390","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5466-0539","authenticated-orcid":false,"given":"Kien","family":"Tran","sequence":"first","affiliation":[{"name":"Department of Computer Science, National Defense Academy of Japan, Yokosuka, Kanagawa 239-8686, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hiroshi","family":"Sato","sequence":"additional","affiliation":[{"name":"Department of Computer Science, National Defense Academy of Japan, Yokosuka, Kanagawa 239-8686, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Masao","family":"Kubo","sequence":"additional","affiliation":[{"name":"Department of Computer Science, National Defense Academy of Japan, Yokosuka, Kanagawa 239-8686, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2020,1,17]]},"reference":[{"key":"ref_1","unstructured":"Kaspersky (2019, November 10). Kaspersky Lab Report. Available online: https:\/\/www.kaspersky.com\/about\/press-release\/2017kaspersky-lab-detects-360000-new-malicious-files-daily."},{"key":"ref_2","unstructured":"Symantec Corporation (2019, August 18). ISTR-Internet Security Threat Report. February 2019; Volume 24. Available online: https:\/\/www.symantec.com\/content\/dam\/symantec\/docs\/reports\/istr-24-2019-en.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"594","DOI":"10.1109\/TPAMI.2006.79","article-title":"One-shot learning of object categories","volume":"28","author":"Li","year":"2006","journal-title":"IEEE Trans. Partern Anal. Mach. Intell."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1332","DOI":"10.1126\/science.aab3050","article-title":"Human-level concept learning through probabilistic program induction","volume":"350","author":"Lake","year":"2015","journal-title":"Science"},{"key":"ref_5","first-page":"195","article-title":"One-shot learning with a hierarchical nonparametric bayesian model","volume":"27","author":"Salakhutdinov","year":"2012","journal-title":"J. Mach. Learn. Res. Proc. Track."},{"key":"ref_6","unstructured":"Santoro, A., Bartunov, S., Botvinick, M., Wierstra, D., and Lillicrap, T. (2016, January 19\u201324). Meta-learning with memory-augmented neural networks. Proceedings of the 33rd International Conference on International Conference on Machine Learning, New York, NY, USA."},{"key":"ref_7","unstructured":"Vinyals, O., Blundell, C., Lillicrap, T., Kavukcuoglu, K., and Wierstra, D. (2016). Matching networks for one shot learning. arXiv, 3630\u20133638."},{"key":"ref_8","unstructured":"Koch, G., Zemel, R., and Salakhutdinov, R. (2020, January 06). Siamese neural networks for one-shot image recognition. Deep Learning Workshop (ICML), Lille Metropole, France, 10\u201311 July 2015. Available online: https:\/\/sites.google.com\/site\/deeplearning2015\/accepted-papers."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Tran, T.K., Sato, H., and Kubo, M. (2018, January 25\u201327). One-shot Learning Approach for Unknown Malware Classification. Proceedings of the 2018 5th Asian Conference on Defense Technology (ACDT), Hanoi, Vietnam.","DOI":"10.1109\/ACDT.2018.8593203"},{"key":"ref_10","unstructured":"FFRI Company (2018, August 18). Introduction to FFRI 2017 Dataset. (In Japanese)."},{"key":"ref_11","unstructured":"Kim, H.K. (2017, August 18). API-Based Malware Detection System Dataset. Available online: http:\/\/ocslab.hksecurity.net\/apimds-dataset."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Sammut, C., and Webb, G.I. (2017). Metalearning. Encyclopedia of Machine Learning and Data Mining, Springer.","DOI":"10.1007\/978-1-4899-7687-1"},{"key":"ref_13","unstructured":"Finn, C., Abbeel, P., and Levine, S. (2017, January 6\u201311). Model-agnostic meta-learning for fast adaptation of deep networks. Proceedings of the 34th International Conference on Machine Learning, Sydney, Australia."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Hochreiter, S., Younger, A.S., and Conwell, P.R. (2001, January 21\u201325). Learning to learn using gradient descent. Proceedings of the International Conference on Artificial Neural Networks (ICANN 2001), Vienna, Austria.","DOI":"10.1007\/3-540-44668-0_13"},{"key":"ref_15","unstructured":"Graves, A., Wayne, G., and Danihelka, I. (2014). Neural turing machines. arXiv."},{"key":"ref_16","unstructured":"Daniel, S. (2019, December 08). Neural Turing Machines: Perils and Promise. Machine Learning Conference 2016. Available online: https:\/\/mlconf.com\/sessions\/neural-turing-machines-are-a-landmark-architecture\/."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"471","DOI":"10.1038\/nature20101","article-title":"Hybrid computing using a neural network with dynamic external memory","volume":"538","author":"Graves","year":"2016","journal-title":"Nature"},{"key":"ref_18","unstructured":"Wu, Y., Wayne, G., Graves, A., and Lillicrap, T. (2018). The Kanerva Machine: A Generative Distributed Memory. arXiv."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Teng, H.S., Chen, K., and Lu, S.C. (1990, January 7\u20139). Adaptive real-time anomaly detection using inductively generated sequential patterns. Proceedings of the 1990 IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, USA.","DOI":"10.1109\/RISP.1990.63857"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1016\/j.cose.2008.08.003","article-title":"Anomaly-based network intrusion detection:Techniques, systems and challenges","volume":"28","author":"Vazquez","year":"2009","journal-title":"Comput. Secur."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Burnaev, E., and Smolyakov, D. (2016, January 12\u201315). One-Class SVM with Privileged Information and Its Application to Malware Detection. Proceedings of the 2016 IEEE 16th International Conference on Data Mining Workshops (ICDMW), Barcelona, Spain.","DOI":"10.1109\/ICDMW.2016.0046"},{"key":"ref_22","unstructured":"Idika, N.C., and Mathur, A.P. (2020, January 06). A Survey of Malware Detection Techniques. Available online: http:\/\/citeseerx.ist.psu.edu\/viewdoc\/download?doi=10.1.1.75.4594&rep=rep1&type=pdf."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"84","DOI":"10.1109\/5326.827457","article-title":"To reject or not to reject: that is the question\u2013an answer in case of neural classifiers","volume":"30","author":"Stefano","year":"2000","journal-title":"IEEE Trans. Syst. Manag. Cybern."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Barbara, D., Couto, J., Jajodia, S., and Wu, N. (2001, January 5\u20137). Detecting novel network intrusions using bayes estimators. Proceedings of the First SIAM International Conference on Data Mining, Chicago, IL, USA.","DOI":"10.1137\/1.9781611972719.28"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Sammut, C., and Webb, G.I. (2017). Inductive Transfer. Encyclopedia of Machine Learning and Data Mining, Springer.","DOI":"10.1007\/978-1-4899-7687-1"},{"key":"ref_26","first-page":"415","article-title":"Support vector machine for malware analysis and classification, Web Intelligence (WI) and Intelligent Agent Technologies (IAT)","volume":"2","author":"Kruczkowski","year":"2014","journal-title":"IEEE Comput. Soc."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Ahmadi, M., Giacinto, G., Ulyanov, D., Semenov, S., and Trofimov, M. (2016, January 9\u201311). Novel feature extraction, selection and fusion for effective malware family classification. Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy (CODASPY), New Orleans, LA, USA.","DOI":"10.1145\/2857705.2857713"},{"key":"ref_28","unstructured":"(2019, December 08). MicroSoft Github Source Code. Available online: https:\/\/github.com\/microsoft\/Detours."},{"key":"ref_29","unstructured":"Christoph Husse, H., and Justin, S. (2019, December 08). Easy Hook Source Code. Available online: https:\/\/easyhook.github.io\/."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Guo, S., Yuan, Q., Lin, F., Wang, F., and Ban, T. (2010, January 22\u201325). A malware detection algorithm based on multi-view fusion. Proceedings of the 17th International Conference on Neural Information Processing: Models and Applications, Sydney, Australia.","DOI":"10.1007\/978-3-642-17534-3_32"},{"key":"ref_31","unstructured":"Mikolov, T., Chen, K., Corrado, G., and Dean, J. (2013). Efficient estimation of word representations in vector space. arXiv."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Cho, K., van Merrienboer, B., Gulcehre, C., Bougares, F., Schwenk, H., and Bengio, Y. (2014, January 25\u201329). Learning phrase representations using RNN encoder decoder for statistical machine translation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Doha, Qatar.","DOI":"10.3115\/v1\/D14-1179"},{"key":"ref_33","unstructured":"Chung, J., Caglar, G., Cho, K., and Bengio, Y. (2014). Empirical evaluation of gated recurrent neural networks on sequence modeling. arXiv."},{"key":"ref_34","unstructured":"Rafal, J., Wojciech, Z., and Ilya, S. (2015, January 6\u201311). An empirical exploration of recurrent network architectures. Proceedings of the 32nd International Conference on Machine Learning (ICML-15), Lille, France."},{"key":"ref_35","unstructured":"Malicia, P. (2020, January 06). Available online: http:\/\/malicia-project.com\/dataset.html."},{"key":"ref_36","unstructured":"(2020, January 06). Virus Total. Available online: https:\/\/virustotal.com."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"659101","DOI":"10.1155\/2015\/659101","article-title":"A novel approach to detect malware based on API call sequence analysis","volume":"11","author":"Ki","year":"2015","journal-title":"Int. J. Distrib. Sens. Netw."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/11\/1\/51\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T14:05:17Z","timestamp":1760364317000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/11\/1\/51"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,1,17]]},"references-count":37,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2020,1]]}},"alternative-id":["info11010051"],"URL":"https:\/\/doi.org\/10.3390\/info11010051","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,1,17]]}}}