A Malware Detection Method of Code Texture Visualization Based on an Improved Faster RCNN Combining Transfer Learning

Zhao, Yuntao; Cui, Wenjie; Geng, Shengnan; Bo, Bo; Feng, Yongxin; Zhang, Wenbo

doi:10.1109/access.2020.3022722

Cited by 32 publications

(17 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Accuracy Recall Precision F1-Score BIRCH [17] 95.02% 90.2% 95.2% 92.3% DART [28] 93.9% 91.2% 89.8% 90.0% GAA-ADS [39] 92.8% 91.3% --RCNN+Transfer Learning [40] 92 We also make a comparison between our work with some existing domain adaptation-based methods such as BIRCH [17], DART [28], GAA-ADS [39], and RCNN+ transfer learning [40], which are shown in Table 3. Our method obtains a higher accuracy and recall than the GAA-ADS and RCNN + transfer learning.…”

Section: Methodsmentioning

confidence: 99%

An Efficient Deep Unsupervised Domain Adaptation for Unknown Malware Detection

Wang¹,

Chai²,

Li³

et al. 2022

Symmetry

View full text Add to dashboard Cite

As an innovative way of communicating information, the Internet has become an indispensable part of our lives. However, it also facilitates a more widespread attack of malware. With the assistance of modern cryptanalysis, emerging malware having symmetric properties, such as encryption and decryption, pack and unpack, presents new challenges to effective malware detection. Currently, numerous malware detection approaches are based on supervised learning. The biggest challenge is that the existing systems rely on a large amount of labeled data, which is usually difficult to gain. Moreover, since the newly emerging malware has a different data distribution from the original training samples, the detection performance of these systems will degrade along with the emergence of new malware. To solve these problems, we propose an Unsupervised Domain Adaptation (UDA)-based malware detection method by jointly aligning the distribution of known and unknown malware. Firstly, the distribution divergence between the source and target domain is minimized with the help of symmetric adversarial learning to learn shared feature representations. Secondly, to further obtain semantic information of unlabeled target domain data, this paper reduces the class-level distribution divergence by aligning the class center of labeled source and pseudo-labeled target domain data. Finally, we mainly use a residual network with a self-attention mechanism to extract more accurate feature information. A series of experiments are performed on two public datasets. Experimental results illustrate that the proposed approach outperforms the existing detection methods with an accuracy of 95.63% and 95.04% in detecting unknown malware on two datasets, respectively.

show abstract

Section: Methodsmentioning

confidence: 99%

An Efficient Deep Unsupervised Domain Adaptation for Unknown Malware Detection

Wang¹,

Chai²,

Li³

et al. 2022

Symmetry

View full text Add to dashboard Cite

show abstract

“…The subsequent steps involve usage of various imaging technologies. In this aspect, various methods have been investigated, including textural method [5]. The recent development in DL has also attracted the application in malware detection mainly due to its ability self-generate features for classification.…”

Section: Volume 2020mentioning

confidence: 99%

Vision-Based Malware Detection: A Transfer Learning Approach Using Optimal ECOC-SVM Configuration

Wong

Juwono²,

Apriono

2021

IEEE Access

View full text Add to dashboard Cite

Malware detection in current times is increasingly important due to the presence of dangerous malicious software (malware) as well as ransomware in digital cyberspace. Conventional approaches such as using malware features (either static or dynamic or hybrid) have been applied for detection. Advances in Deep Learning (DL) has attracted a lot of interests in applications of malware detection. In particular, the file binaries are fed in to the DL neural network for training and testing. Despite the theoretical basis, we find that overfitting has occurred despite applying precaution, such as applying sufficient dropout layers. Limitations can also be attributed to the final classification layers (fully connected shallow network and softmax classification). In this paper, we apply transfer learning using ShuffleNet and DenseNet-201, two models trained on large dataset to recognize daily objects. This is done with the entire layers frozen to prevent overfitting and an optimal Error correction output code (ECOC) ensemble configuration of Support Vector Machines (SVM). Several ECOC coding matrices were applied, e.g., One vs. All (OVA), One vs. One (OVO), Dense Random (DR), and Sparse Random (SR). Each of these configurations represents varying complexity and ensemble size and, hence, a tradeoff between computation reduction and complex non-linear separation appears. Given that the continuous values of SVM parameters may take up high computation for acquiring the optimal parameter configuration, we apply discrete values combination using a grid search approach for parameter optimization. We test the proposed model on Malimg, MaleVis, virus-MNIST, and Dumpware10 datasets. The results show better/comparable accuracy compared with the existing work. The best/average accuracy values for each dataset over 10 trials are: Malimg (99.14%/98.87%), MaleVis (95.01%/93.91%), Virus-MNIST (86.36%/85.79%), Dumpware10 (96.62%/95.79%).

show abstract

“…Nataraj et al [33] first proposed to visualize malware binaries as grayscale images and classify malware according to the similarity of image textures. Some researchers refer to the processing methods of images of different sizes in the image field, and use deformation processing such as cutting or scaling to convert malicious code images to a fixed size [52]; however, these methods will cause the loss of malicious code data and the destruction of code structure. This paper utilized the method to visualize malicious code, which converts binary code into three-channel image as Wang et al did in their paper [49].…”

Section: Transforming Malware Byte Files Into Imagesmentioning

confidence: 99%

MalCaps: A Capsule Network Based Model for the Malware Classification

Zhang

Chen

et al. 2021

Processes

View full text Add to dashboard Cite

The research on malware detection enabled by deep learning has become a hot issue in the field of network security. The existing malware detection methods based on deep learning suffer from some issues, such as weak ability of deep feature extraction, relatively complex model, and insufficient ability of model generalization. Traditional deep learning architectures, such as convolutional neural networks (CNNs) variants, do not consider the spatial hierarchies between features, and lose some information on the precise position of a feature within the feature region, which is crucial for a malware file which has specific sections. In this paper, we draw on the idea of image classification in the field of computer vision and propose a novel malware detection method based on capsule network architecture with hyper-parameter optimized convolutional layers (MalCaps), which overcomes CNNs limitations by removing the need for a pooling layer and introduces capsule layers. Firstly, the malware is transformed into a grayscale image. Then, the dynamic routing-based capsule network is used to detect and classify the image. Without advanced feature extraction and with only a small number of labeled samples, the presented method is tested on an unbalanced Microsoft Malware Classification Challenge (MMCC) dataset and experimental results produce testing accuracy of 99.34%, improving on a number of traditional deep learning models posited in recent malware classification literature.

show abstract

A Malware Detection Method of Code Texture Visualization Based on an Improved Faster RCNN Combining Transfer Learning

Cited by 32 publications

References 19 publications

An Efficient Deep Unsupervised Domain Adaptation for Unknown Malware Detection

An Efficient Deep Unsupervised Domain Adaptation for Unknown Malware Detection

Vision-Based Malware Detection: A Transfer Learning Approach Using Optimal ECOC-SVM Configuration

MalCaps: A Capsule Network Based Model for the Malware Classification

Contact Info

Product

Resources

About