Classification and Analysis of Android Malware Images Using Feature Fusion Technique

Singh, Jaiteg; Thakur, Deepak; Gera, Tanya; Shah, Babar; Abuhmed, Tamer; Ali, Farman

doi:10.1109/access.2021.3090998

Cited by 54 publications

(28 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, work in [1,2,3] proposes use of call graphs, system calls, and explainable Artificial Intelligence (AI) methods for improving classification & localization performance under real-time cyber physical systems. Similar models are discussed in [4,5,6 [10], and Metamorphic Malware detection via Genetic Algorithm (MMGA) [11] are discussed by researchers. These models utilize large-scale & high-density feature extraction techniques in order to improve accuracy of detection & localization of malwares with different signatures.…”

Section: Literature Reviewmentioning

confidence: 95%

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

Pateriya

Tomar

2022

Preprint

View full text Add to dashboard Cite

Classification of malwares from spatial & temporal data patterns requires efficient design of deep learning models. These models deploy methods for feature extraction, feature selection, classification & post-processing to perform this task. A wide variety of high-efficiency malware analysis models are proposed by researchers, and most of them are application-specific, thus cannot be scaled to multiple domains. Out of these, only a few of these models are targeted towards identification of malware locations. In order to improve malware detection scalability, and localization performance, this text proposes a novel augmented convolutional model (ACM) for intelligent cross-domain malware analysis via forensic neural networks (FNNs). The FNNs are designed as an integration of multiple augmented convolutional models, which include different optimizers & feature extraction units. In this design, each of these units are customized to improve their feature extraction & selection capabilities, which assists in improving classification performance. Results of classification are given to an ACM layer, which performs feature augmentation to localize malware positions in input data. The proposed model was evaluated on multiple malware datasets, including Electro RAT, Pegasus, SkyGoFree, Viking Horde, Bat Skull, Yesmile, Wirenet, Jigsaw, Satana, Tapaoux, etc. It was observed that the proposed model was able to classify these malwares with an average accuracy of 98.5%, which makes it useful for real-time malware analysis. The model was also able to achieve an average localization accuracy of 79.6% across these datasets, thereby assisting forensic experts to obtain an approximate estimate of malware locations in input data streams. This performance was compared with some of the recently proposed malware detection models, and it was observed that the proposed ACMFNN method has 8% better precision, 6.5% better recall, and 9.4% better classification accuracy when compared with these methods on the same dataset. Due to augmented convolutional model, it was observed that the proposed approach had 15% better localization accuracy, 19% better localization precision, and 14% better localization recall when compared with these methods. Thereby indicating that the propose model is applicable for a wide variety of malware detection & localization application deployments.

show abstract

Section: Literature Reviewmentioning

confidence: 95%

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

Pateriya

Tomar

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…In [ 120 ], it is proposed to visualize malicious Android applications and then classify the obtained images. SVM, KNN, and Random Forest are used for this purpose.…”

Section: Systematization Of Sa Stages and ML Solutionsmentioning

confidence: 99%

Static Analysis of Information Systems for IoT Cyber Security: A Survey of Machine Learning Approaches

Kotenko

Izrailov

Buinevich

2022

Sensors

View full text Add to dashboard Cite

Ensuring security for modern IoT systems requires the use of complex methods to analyze their software. One of the most in-demand methods that has repeatedly been proven to be effective is static analysis. However, the progressive complication of the connections in IoT systems, the increase in their scale, and the heterogeneity of elements requires the automation and intellectualization of manual experts’ work. A hypothesis to this end is posed that assumes the applicability of machine-learning solutions for IoT system static analysis. A scheme of this research, which is aimed at confirming the hypothesis and reflecting the ontology of the study, is given. The main contributions to the work are as follows: systematization of static analysis stages for IoT systems and decisions of machine-learning problems in the form of formalized models; review of the entire subject area publications with analysis of the results; confirmation of the machine-learning instrumentaries applicability for each static analysis stage; and the proposal of an intelligent framework concept for the static analysis of IoT systems. The novelty of the results obtained is a consideration of the entire process of static analysis (from the beginning of IoT system research to the final delivery of the results), consideration of each stage from the entirely given set of machine-learning solutions perspective, as well as formalization of the stages and solutions in the form of “Form and Content” data transformations.

show abstract

“…Maria et al [11] extracted Speeded Up Robust Features (SURF) and Histogram of Oriented Gradients (HOG) from malware gray image. Singh et al [12] exacted Gray Level Co-occurrence Matrix-based (GLCM), Global Image Descriptors (GIST), and Local Binary Pattern (LBP) from malware gray image. However, these methods still extracted information from the original gray image, and did not enhance the image in essence.…”

Section: Vision-based Analysismentioning

confidence: 99%

PH-CNN for PE Malware Detection Using Enhanced Image

2022

Preprint

View full text Add to dashboard Cite

In the current malware family classification, gray images converted frombinary PE files are subject to code shelling, obfuscation, and other variant techniques, which undermine the similarity of malware images between same family. To solve this problem and improve detection efficiency, a method by enhancing the gray image and using PH-CNN as the detection model is proposed. First, the original image is enhanced by discarding the subjectively set machine code (DSMD) and adding section distribution information (ASDI), and then the enhanced imageis detected by PH-CNN model. Among them, the PH-CNN model consists of Perceptual Hashing detection module and CNN detection module. Malware images are first detected by Perceptual Hashing module to quickly divide the samples of specific malware families and uncertain malware families, and then, the samples of uncertain malware families are detected by the CNN detection module. The experimental results on Microsoft Malware Classification Challenge dataset show that compared with the original gray image, the detection accuracy using enhanced image is higher, reaching 98.68%. Meanwhile, compared with using only CNN module, the proposed detection model has higher detection efficiency and the detection speed is improved by 79%.

show abstract

Classification and Analysis of Android Malware Images Using Feature Fusion Technique

Cited by 54 publications

References 48 publications

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

ACMFNN: Design of an augmented convolutional model for intelligent cross-domain malware localization via forensic neural networks

Static Analysis of Information Systems for IoT Cyber Security: A Survey of Machine Learning Approaches

PH-CNN for PE Malware Detection Using Enhanced Image

Contact Info

Product

Resources

About