Malware Classification Using Probability Scoring and Machine Learning

Abstract

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174 607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively. INDEX TERMS Grayscale image, native API call, malware, machine learning, probability scoring, static and dynamic analysis.

Incremental Learning for Malware Classification in Small Datasets

“…In our previous study [7], it has been demonstrated that the opcode sequences captured by variable-length n-grams (n � 2, 3, 4) are more meaningful than fixed-length n-grams.…”

“…So far, malware classification methods mainly focus on feature engineering, which need to extract features from malware or visualization images, for example, API calls [6,7], system calls [8,9], and opcode sequences [10,11]. e malware classification framework in our work is closely related to opcode sequences and SVM.…”

A Review of Computer Vision Methods in Network Security

“…To overcome the drawbacks of code obfuscation and high computational costs of analysing malware, Xue et al [137] recently proposed Malscore, which is based on the probability scoring and machine learning. The purpose of probability scoring is to decide if static analysis needs to concatenate with dynamic analysis.…”

Malicious Traffic Detection in IoT and Local Networks Using Stacked Ensemble Classifier

“…The study utilizes the convolutional neural networks (CNN) for classification and achieved 99.97% and 98.52% accuracy on Microsoft and Malimg datasets, respectively. A malware classification system called 'Malscore' was proposed in [10] which is based on machine learning models and probability scoring. The proposed system works in two phases, where, CNN is utilized with spatial pyramid pooling to examine grayscale images in phase 1, and several n-grams and ML models have been integrated to examine the dynamic features in phase 2.…”