Malware Classification Using Image Representation

Singh, Ajay Pratap; Handa, Anand; Kumar, Nitesh; Shukla, Sandeep K.

doi:10.1007/978-3-030-20951-3_6

Cited by 55 publications

(29 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The four benchmark malware datasets used to analyze the performance of the proposed deep forest-based malware detection system are the Malimg dataset [31] and the BIG 2015 dataset [2], MaleVis dataset [6] and Malware dataset [38]. The cleanware samples are self-collected containing 1044 files, and they were checked using the VirusTotal [41] The fourth dataset is a part of malicia dataset [46] that was chosen to validate the efficiency of the proposed malware detector.…”

Section: A Datasets and Experiments Setupmentioning

confidence: 99%

Intelligent Vision-Based Malware Detection and Classification Using Deep Random Forest Paradigm

et al. 2020

View full text Add to dashboard Cite

Malware is a rapidly increasing menace to modern computing. Malware authors continually incorporate various sophisticated features like code obfuscations to create malware variants and elude detection by existing malware detection systems. The classification of unseen malware variants with similar characteristics into their respective families is a significant challenge, even if the classifier is trained with known variants belonging to the same family. The identification and extraction of distinct features for each malware is another issue for generalizing the malware detection system. Features that contribute to the generalization capability of the classifier are difficult to be engineered with modifications in each malware. Conventional malware detection systems employ static signature-based methods and dynamic behavior-based methods, which are inefficient in analyzing and detecting advanced and zero-day malware. To address these issues, this work employs a visualization approach where malware is represented as 2D images and proposes a robust machine learning-based anti-malware solution. The proposed system is based on a layered ensemble approach that mimics the key characteristics of deep learning techniques but performs better than the latter. The proposed system does not require hyperparameter tuning or backpropagation and works with reduced model complexity. The proposed model outperformed other state-of-the-art techniques with a detection rate of 98.65%, 97.2%, and 97.43% for Malimg, BIG 2015, and MaleVis malware datasets, respectively. The results demonstrate that the proposed solution is effective in identifying new and advanced malware due to its diverse features.

show abstract

Section: A Datasets and Experiments Setupmentioning

confidence: 99%

Intelligent Vision-Based Malware Detection and Classification Using Deep Random Forest Paradigm

et al. 2020

View full text Add to dashboard Cite

show abstract

“…In particular, the Microsoft Malware Classification Challenge has spurred a large interest in using CNNs for malware detection [8]. For instance, the author of [9] used a CNN to acheive 95.24% accuracy on a test set of over 40,000 samples, and then used a residual network to achieve 98.21% accuracy on the same samples. The author also notes that the test set was limited to a certain size of binaries and that future work should expand to any length of binaries.…”

Section: Related Workmentioning

confidence: 99%

Detecting Malicious Assembly using Convolutional, Recurrent Neural Networks

Santacroce¹,

Koranek²,

Jha³

2019

Adv. sci. technol. eng. syst. j.

View full text Add to dashboard Cite

We present findings on classifying the class of executable code using convolutional, recurrent neural networks by creating images from only the .text section of executables and dividing them into standard-size windows, using minimal preprocessing. We achieve up to 98.24% testing accuracy on classifying 9 types of malware, and 99.50% testing accuracy on classifying malicious vs. benign code. Then, we find that a recurrent network may not entirely be necessary, opening the door for future neural network architectures.

show abstract

“…The proposed model uses CNN with machine learning algorithms as an intelligent system that classifies malware images efficiently to the respective classes. Papers [18,23,50] hybrid CNN works better than CNN. This paper [23] presents a hybrid CNN model with SVM to reduce the computational requirements and accuracy.…”

Section: Hybrid Cnn (Cnn + Svm)mentioning

confidence: 98%

“…In the last few years, researchers formulated the malware classification problem as an image classification problem [50]. Binary texture feature extraction is prone to binary obfuscation techniques that can be handled by converting binaries into gray-scale images [7].…”

Section: Converting Malware Binaries Into Imagesmentioning

confidence: 99%

Malware Classification with Improved Convolutional Neural Network Model

Lad¹,

Adamuthe²

2021

IJCNIS

View full text Add to dashboard Cite

Malware is a threat to people in the cyber world. It steals personal information and harms computer systems. Various developers and information security specialists around the globe continuously work on strategies for detecting malware. From the last few years, machine learning has been investigated by many researchers for malware classification. The existing solutions require more computing resources and are not efficient for datasets with large numbers of samples. Using existing feature extractors for extracting features of images consumes more resources. This paper presents a Convolutional Neural Network model with pre-processing and augmentation techniques for the classification of malware gray-scale images. An investigation is conducted on the Malimg dataset, which contains 9339 gray-scale images. The dataset created from binaries of malware belongs to 25 different families. To create a precise approach and considering the success of deep learning techniques for the classification of raising the volume of newly created malware, we proposed CNN and Hybrid CNN+SVM model. The CNN is used as an automatic feature extractor that uses less resource and time as compared to the existing methods. Proposed CNN model shows (98.03%) accuracy which is better than other existing CNN models namely VGG16 (96.96%), ResNet50 (97.11%) InceptionV3 (97.22%), Xception (97.56%). The execution time of the proposed CNN model is significantly reduced than other existing CNN models. The proposed CNN model is hybridized with a support vector machine. Instead of using Softmax as activation function, SVM performs the task of classifying the malware based on features extracted by the CNN model. The proposed fine-tuned model of CNN produces a well-selected features vector of 256 Neurons with the FC layer, which is input to SVM. Linear SVC kernel transforms the binary SVM classifier into multi-class SVM, which classifies the malware samples using the one-against-one method and delivers the accuracy of 99.59%.

show abstract

Malware Classification Using Image Representation

Cited by 55 publications

References 18 publications

Intelligent Vision-Based Malware Detection and Classification Using Deep Random Forest Paradigm

Intelligent Vision-Based Malware Detection and Classification Using Deep Random Forest Paradigm

Detecting Malicious Assembly using Convolutional, Recurrent Neural Networks

Malware Classification with Improved Convolutional Neural Network Model

Contact Info

Product

Resources

About