A deep learning approach to program similarity

Marastoni, Niccolò; Giacobazzi, Roberto; Preda, Mila Dalla

doi:10.1145/3243127.3243131

Cited by 22 publications

(29 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As stated in the previous subsection, CNNs excel at extracting spatial features from data. This is invaluable when classifying or generally working with natural images, but images extracted from code reveal different types of patterns altogether and therefore comprise a different learning problem [26].…”

Section: Long Short-term Memorymentioning

confidence: 99%

“…This process of generating new data from existing images is known as data augmentation and it is a staple of deep learning. This is a key factor in the approach that was first introduced in [26].…”

Section: Introductionmentioning

confidence: 99%

“…Since obfuscations generate syntactic variants of programs but maintain their semantics, they can be seen as data-augmentation transformations specific to code. This is the main intuition of [26], where 47 small programs with different semantics have been transformed iteratively by applying obfuscations and generating 200 variants each, resulting in a final dataset that contains 9 400 samples divided in 47 classes.…”

Section: Introductionmentioning

confidence: 99%

“…In this paper we generate a dataset of 18 800 obfuscated programs with the aforementioned technique, reaching a size that is roughly double than the one generated in [26] with the same technique. We then train two deep neural network models, a convolutional neural network (CNN) and a bidirectional long short-term memory (LSTM) and achieve an average accuracy around 93% on the generated dataset.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Data augmentation and transfer learning to classify malware images in a deep learning context

Marastoni

Giacobazzi

Preda

2021

J Comput Virol Hack Tech

Self Cite

View full text Add to dashboard Cite

In the past few years, malware classification techniques have shifted from shallow traditional machine learning models to deeper neural network architectures. The main benefit of some of these is the ability to work with raw data, guaranteed by their automatic feature extraction capabilities. This results in less technical expertise needed while building the models, thus less initial pre-processing resources. Nevertheless, such advantage comes with its drawbacks, since deep learning models require huge quantities of data in order to generate a model that generalizes well. The amount of data required to train a deep network without overfitting is often unobtainable for malware analysts. We take inspiration from image-based data augmentation techniques and apply a sequence of semantics-preserving syntactic code transformations (obfuscations) to a small dataset of programs to generate a larger dataset. We then design two learning models, a convolutional neural network and a bi-directional long short-term memory, and we train them on images extracted from compiled binaries of the newly generated dataset. Through transfer learning we then take the features learned from the obfuscated binaries and train the models against two state of the art malware datasets, each containing around 10 000 samples. Our models easily achieve up to 98.5% accuracy on the test set, which is on par or better than the present state of the art approaches, thus validating the approach.

show abstract

Section: Long Short-term Memorymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Data augmentation and transfer learning to classify malware images in a deep learning context

Marastoni

Giacobazzi

Preda

2021

J Comput Virol Hack Tech

Self Cite

View full text Add to dashboard Cite

show abstract

“…This proposed work is able to solve the problem of cross-architecture code containment problem. DL approach was applied to binary code visualization to solve the problem of binary code similarities was proposed in [95]. Basically binary code was represented as an images and then DL algorithm for image classification were used in this work.…”

Section: G Deep Learning In Function Recognitionmentioning

confidence: 99%