Malware variant detection using similarity search over content fingerprint

Ban, Xiaofang; Li, Chen; Hu, Weihua; Qu, Wenyu

doi:10.1109/ccdc.2014.6852216

Cited by 17 publications

(15 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Kosmidis et al [21] conducted a more in-depth study on the texture features of malware and tested the performance of different classifiers on the dataset based on machine learning algorithms. Based on these studies, Xiaofang et al [22], Naeem et al [6], [23] and Hashemi et al [24] conducted more researches based on different texture features (e.g. SURF, LBP, DSIFT), and achieved better performance.…”

Section: Malware Detection Based On Texture Featuresmentioning

confidence: 99%

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

Guo

Huang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

With the rapid development of the Internet, malware variants have increased exponentially, which poses a key threat to cyber security. Persistent efforts have been made to classify malware variants, but there are still many challenges, including the incapacity to deal with various malware variants belonging to similar families, the problem of time and resource consuming, etc. This paper proposes a novel method, called Malware Entropy Sequences Reflect the Family (MESRF), to improve the classification of malware based on the entropy sequences features. In prior research, entropy demonstrated good performance in many areas. First, the global features of the signals were extracted from the entropy sequences by some statistical methods. Next, some local features (i.e. structural entropy features) are extracted based on the discrete wavelet decomposition algorithm and vectorized by the Bag-of-words model, endowing it the high accuracy of malware classification. To evaluate our method, we conducted numerous experiments on the malware datasets with more than 20,000 samples. Through experiments, MESRF showed superiority comparing with other malware classification models, and the accuracy and ROC of the method even could reach 99.83% and 99.98% respectively on the malimg dataset.

show abstract

Section: Malware Detection Based On Texture Featuresmentioning

confidence: 99%

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

Guo

Huang

et al. 2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…After that, they used a k-nearest neighbor algorithm to classify malware. Xiaofang et al [23] visualized malware as gray images and extracted image features with a speeded-up robust features algorithm. The research of Liu and Wang [24] also focused on the gray image, and the local mean method was used to reduce the image size to speed up the ensemble learning process.…”

Section: B Visualizationmentioning

confidence: 99%

The Image Game: Exploit Kit Detection Based on Recursive Convolutional Neural Networks

2020

View full text Add to dashboard Cite

Malware has been installed through drive-by downloads via exploit kit attacks. However, the prior signature-or dynamic-based detection approach to the continuously increasing number of suspicious samples is time-consuming. In such circumstances, convolutional neural networks (ConvNets) can help in rapid detection owing to their direct image-feature generation using exploit codes. However, the general ConvNet model entails the vanishing gradient problem, where the features used for a deep learning-based detection method will become less effective as the network is deepened to improve detection accuracy. In this paper, we propose a multiclass ConvNet model to classify exploit kits, where we adopt various image processing techniques and adjust the size and other parameters of images. The proposed ConvNet model recursively updates images and is designed for fully preserving image properties. This model updates the output of feature maps and pooling using an original image. This model was tested using 36,863 real-world datasets, achieving a 98.2% accuracy in exploit kit detection and family classification. Most importantly, the proposed model is 38 times faster than previous machine learning models, and training time is reduced by 77.8% when compared with prior well-known ConvNet models. INDEX TERMS Exploit kit, image processing, ConvNet, image classification.

show abstract

“…In the second step, these texture features classified by using machine-learning techniques such as classification and clustering to identify malware. Subsequently, Ban Xiao Fang et al [17] proposed a malware detection method that extracted local binary features using SURF and then did fast fingerprint matching with LSH schemes.…”

Section: Related Workmentioning

confidence: 99%

“…Although works mentioned above [13], [14], [15], [16] and [17] are helpful to detect and classify new malware and their variants, still they have some limitations. For instance, on the one hand, global texture features lose local information needed for classification.…”

Section: Related Workmentioning

confidence: 99%

“…The classifications and detections of CP-MVCS performed by Matlab [23] and Weka [24], which are open source data mining tools. Previously, several works [13,14,15,16,17] used machine-learning classification for malware detection with Naïve Bayes (NB), Nearest Neighbor (KNN) and Support Vector Machine (SVM). To obtain the best suitable classifier for experimentation, these classifiers compared with each other on Malimg dataset, as shown in Table 1.…”

Section: Experimental Setup and Settingmentioning

confidence: 99%

See 1 more Smart Citation

A Cross-Platform Malware Variant Classification based on Image Representation

2019

KSII TIIS

View full text Add to dashboard Cite

Recent internet development is helping malware researchers to generate malicious code variants through automated tools. Due to this reason, the number of malicious variants is increasing day by day. Consequently, the performance improvement in malware analysis is the critical requirement to stop the rapid expansion of malware. The existing research proved that the similarities among malware variants could be used for detection and family classification. In this paper, a Cross-Platform Malware Variant Classification System (CP-MVCS) proposed that converted malware binary into a grayscale image. Further, malicious features extracted from the grayscale image through Combined SIFT-GIST Malware (CSGM) description. Later, these features used to identify the relevant family of malware variant. CP-MVCS reduced computational time and improved classification accuracy by using CSGM feature description along machine learning classification. The experiment performed on four publically available datasets of Windows OS and Android OS. The experimental results showed that the computation time and malware classification accuracy of CP-MVCS was higher than traditional methods. The evaluation also showed that CP-MVCS was not only differentiated families of malware variants but also identified both malware and benign samples in mix fashion efficiently.

show abstract

Malware variant detection using similarity search over content fingerprint

Cited by 17 publications

References 14 publications

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

File Entropy Signal Analysis Combined With Wavelet Decomposition for Malware Classification

The Image Game: Exploit Kit Detection Based on Recursive Convolutional Neural Networks

A Cross-Platform Malware Variant Classification based on Image Representation

Contact Info

Product

Resources

About