Visualization and deep-learning-based malware variant detection using OpCode-level features

Darem, A. Basit; Abawajy, Jemal; Makkar, Aaisha; Alhashmi, Asma A.; Alanazi, Sultan M.

doi:10.1016/j.future.2021.06.032

Cited by 57 publications

(19 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It takes advantage of visual converters that both mine long-range dependencies and compute in parallel, allowing it to outperform most other deep learning models for malware identification. Through comparison, it is easy to see that traditional machine learning algorithms have been difficult to achieve better results in the field of malicious image recognition, and the future research will focus more on the field of deep learning [20][21]25]. Our method also has some drawbacks, ViT itself has the disadvantage of being computationally intensive and relying on large-scale datasets.…”

Section: Comparison Of Results For Different Architecturesmentioning

confidence: 99%

Malware Family Classification Based on Vision Transformer

Li¹,

Li²

2023

Journal of Compurters

View full text Add to dashboard Cite

<p>Cybersecurity worries intensify as Big Data, the Internet of Things, and 5G technologies develop. Based on code reuse technologies, malware creators are producing new malware quickly, and new malware is continually endangering the effectiveness of existing detection methods. We propose a vision transformer-based approach for malware picture identification because, in contrast to CNN, Transformer’s self-attentive process is not constrained by local interactions and can simultaneously compute long-range mine relationships. We use ViT-B/16 weights pre-trained on the ImageNet21k dataset to improve model generalization capability and fine-tune them for the malware image classification task. This work demonstrates that (i) a pure attention mechanism applies to malware recognition, and (ii) the Transformer can be used instead of traditional CNN for malware image recognition. We train and assess our models using the MalImg dataset and the BIG2015 dataset in this paper. Our experimental evaluation found that the recognition accuracy of transfer learning-based ViT for MalImg samples and BIG2015 samples is 99.14% and 98.22%, respectively. This study shows that training ViT models using transfer learning can perform better than CNN in malware family classification.</p> <p> </p>

show abstract

Section: Comparison Of Results For Different Architecturesmentioning

confidence: 99%

Malware Family Classification Based on Vision Transformer

Li¹,

Li²

2023

Journal of Compurters

View full text Add to dashboard Cite

show abstract

“…It should be noted that since different CPU architectures have different instruction sets, the opcodes are also different. Therefore, detecting malware samples across architectures requires considering the opcodes in each CPU architecture, leading to a computationally intensive process [ 27 , 28 , 29 , 30 , 31 , 32 , 33 , 34 , 35 , 36 , 37 , 38 ].…”

Section: Related Workmentioning

confidence: 99%

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

Zhao

Kuerban

2023

Sensors

View full text Add to dashboard Cite

With the development of internet technology, the Internet of Things (IoT) has been widely used in several aspects of human life. However, IoT devices are becoming more vulnerable to malware attacks due to their limited computational resources and the manufacturers’ inability to update the firmware on time. As IoT devices are increasing rapidly, their security must classify malicious software accurately; however, current IoT malware classification methods cannot detect cross-architecture IoT malware using system calls in a particular operating system as the only class of dynamic features. To address these issues, this paper proposes an IoT malware detection approach based on PaaS (Platform as a Service), which detects cross-architecture IoT malware by intercepting system calls generated by virtual machines in the host operating system acting as dynamic features and using the K Nearest Neighbors (KNN) classification model. A comprehensive evaluation using a 1719 sample dataset containing ARM and X86-32 architectures demonstrated that MDABP achieves 97.18% average accuracy and a 99.01% recall rate in detecting samples in an Executable and Linkable Format (ELF). Compared with the best cross-architecture detection method that uses network traffic as a unique type of dynamic feature with an accuracy of 94.5%, practical results reveal that our method uses fewer features and has higher accuracy.

show abstract

“…Darem et al [ 54 ] focused on the work of malware classification or identification by using the obfuscated malware opcodes present as ASM files that were converted into grayscale images during the processing stage. The images were generated based on the features extracted during the feature engineering stage.…”

Section: Introductionmentioning

confidence: 99%

Transfer Learning for Image-Based Malware Detection for IoT

Panda

Kumar

Marappan

et al. 2023

Sensors

View full text Add to dashboard Cite

The tremendous growth in online activity and the Internet of Things (IoT) led to an increase in cyberattacks. Malware infiltrated at least one device in almost every household. Various malware detection methods that use shallow or deep IoT techniques were discovered in recent years. Deep learning models with a visualization method are the most commonly and popularly used strategy in most works. This method has the benefit of automatically extracting features, requiring less technical expertise, and using fewer resources during data processing. Training deep learning models that generalize effectively without overfitting is not feasible or appropriate with large datasets and complex architectures. In this paper, a novel ensemble model, Stacked Ensemble—autoencoder, GRU, and MLP or SE-AGM, composed of three light-weight neural network models—autoencoder, GRU, and MLP—that is trained on the 25 essential and encoded extracted features of the benchmark MalImg dataset for classification was proposed. The GRU model was tested for its suitability in malware detection due to its lesser usage in this domain. The proposed model used a concise set of malware features for training and classifying the malware classes, which reduced the time and resource consumption in comparison to other existing models. The novelty lies in the stacked ensemble method where the output of one intermediate model works as input for the next model, thereby refining the features as compared to the general notion of an ensemble approach. Inspiration was drawn from earlier image-based malware detection works and transfer learning ideas. To extract features from the MalImg dataset, a CNN-based transfer learning model that was trained from scratch on domain data was used. Data augmentation was an important step in the image processing stage to investigate its effect on classifying grayscale malware images in the MalImg dataset. SE-AGM outperformed existing approaches on the benchmark MalImg dataset with an average accuracy of 99.43%, demonstrating that our method was on par with or even surpassed them.

show abstract

Visualization and deep-learning-based malware variant detection using OpCode-level features

Cited by 57 publications

References 21 publications

Malware Family Classification Based on Vision Transformer

Malware Family Classification Based on Vision Transformer

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

Transfer Learning for Image-Based Malware Detection for IoT

Contact Info

Product

Resources

About