A Novel Malware Detection System Based On Machine Learning and Binary Visualization

Abstract

The continued evolution and diversity of malware constitutes a major threat in modern systems. It is well proven that security defenses currently available are ineffective to mitigate the skills and imagination of cyber-criminals necessitating the development of novel solutions. Deep learning algorithms and artificial intelligence (AI) are rapidly evolving with remarkable results in many application areas. Following the advances of AI and recognizing the need for efficient malware detection methods, this paper presents a new approach for malware detection based on binary visualization and self-organizing incremental neural networks. The proposed method's performance in detecting malicious payloads in various file types was investigated and the experimental results showed that a detection accuracy of 91.7% and 94.1% was achieved for ransomware in .pdf and .doc files respectively. With respect to other formats of malicious code and other file types, including binaries, the proposed method behaved well with an incremental detection rate that allows efficiently detecting unknown malware at real-time.

Malware Squid: A Novel IoT Malware Traffic Analysis Framework Using Convolutional Neural Network and Binary Visualisation

“…7, the images had a very high frequency of green pixels, more than any type of traffic recorded. High levels of green pixels represent an abuse of the use in control characters [14], attacks commonly use control characters to hide data in packets that are malicious in nature [25].…”

“…Although the CPU and memory features were effective, they require a lot of set up time and reconstruction of a testing network, making the method rather difficult to implement. In [14], the authors built a similar malware detection tool that focused on malware executables as opposed to traffic. This work also had analysis of binary visualisations through a neural network.…”

“…In this work, we use a visual representation algorithm of the traffic collected that is based on Binvis [17]. This binary data visualization tool converts the contents of a binary file to another domain that can be visually represented (typically a two-dimensional space) [14]. Binvis represents the different ASCII values by using red, green and blue colour classes as shown in Table 1, while black (0x00) and white (0xFF) classes are used to represent null and (non-breaking) spaces.…”

“…3 and 4. This algorithm surmounts other curves in preserving the locality between objects in multi-dimensional spaces [14,18], thus creating a much more appropriate imprint of the image. This helps the machine learning neural network analysis the image for anomalies in normal traffic.…”

A Novel Approach to Detect Phishing Attacks using Binary Visualisation and Machine Learning

“…In this paper, we aim to tackle these two main issues by combining the phishing threat with binary visualisation and machine learning. This combination can lead to faster access time with high accuracy as shown in [24]. In [24], binary visualisation and machine learning were used for malware classification with promising results.…”