Binary malware image classification using machine learning with local binary pattern

Luo, Jhu-Sin; Lo, Dan

doi:10.1109/bigdata.2017.8258512

Cited by 60 publications

(22 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The first is that grayscale images and API sequences are learned by learning algorithms different from CNN and RF [6], [15], [45], [49], [50]. The second is that malware features different from gray image and API sequence are learned by CNN and RF algorithms [51]- [53]. The last is that learning algorithms and malware features different from those of Malscore [23], [54]- [57].…”

Section: H Comparison With Other Similar Methodsmentioning

confidence: 99%

Malware Classification Using Probability Scoring and Machine Learning

Xue

et al. 2019

IEEE Access

View full text Add to dashboard Cite

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174 607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively. INDEX TERMS Grayscale image, native API call, malware, machine learning, probability scoring, static and dynamic analysis.

show abstract

Section: H Comparison With Other Similar Methodsmentioning

confidence: 99%

Malware Classification Using Probability Scoring and Machine Learning

Xue

et al. 2019

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Recently deep machine learning and image processing techniques were integrated and used to detect malware. Cui et al [11] and Luo [32] used CNN to extract features of malware images automatically. Both approaches achieved high accuracy in detecting malware.…”

Section: ) Cybersecuritymentioning

confidence: 99%

SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

et al. 2021

View full text Add to dashboard Cite

“…To validate the advantages and efficiency of our proposed method, we compared our model with five advanced malware classification models. These models respectively adopt image feature extraction schemes based on malware grayscale image similar to bytecode image (Nataraj et al, 2011a;Luo & Lo, 2017;Cui et al, 2019;Venkatraman, Alazab & Vinayakumar, 2019) and text feature extraction scheme (Santos et al, 2013). As shown in Table 8, in terms of bytecode images, the accuracy of traditional image feature extraction technology such as Gist and local binary pattern (LBP) only reaches about 90%, while the accuracy of using CNN to classify malware images exceeds 95%, and the F-measure is also higher.…”

Section: Comparison With Other Workmentioning

confidence: 99%

Malware homology determination using visualized images and feature fusion

Zhu

Huang

Wang

et al. 2021

PeerJ Computer Science

View full text Add to dashboard Cite

The family homology determination of malware has become a research hotspot as the number of malware variants are on the rise. However, existing studies on malware visualization only determines homology based on the global structure features of executable, which leads creators of some malware variants with the same structure intentionally set to misclassify them as the same family. We sought to develop a homology determination method using the fusion of global structure features and local fine-grained features based on malware visualization. Specifically, the global structural information of the malware executable file was converted into a bytecode image, and the opcode semantic information of the code segment was extracted by the n-gram feature model to generate an opcode image. We also propose a dual-branch convolutional neural network, which features the opcode image and bytecode image as the final family classification basis. Our results demonstrate that the accuracy and F-measure of family homology classification based on the proposed scheme are 99.05% and 98.52% accurate, respectively, which is better than the results from a single image feature or other major schemes.

show abstract

Binary malware image classification using machine learning with local binary pattern

Cited by 60 publications

References 11 publications

Malware Classification Using Probability Scoring and Machine Learning

Malware Classification Using Probability Scoring and Machine Learning

SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

Malware homology determination using visualized images and feature fusion

Contact Info

Product

Resources

About