Classification of Malware Families Based on Efficient-Net and 1D-CNN Fusion

Chong, Xulei; Gao, Yating; Zhang, Ru; Huang, Xingjie; Zhao, Jinmeng

doi:10.3390/electronics11193064

Cited by 2 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It employs two CNNs using two different modalities as input: a byte sequence and an opcode sequence. In [12], Efficient-Net processed malware images visualized from disassembled files, and 1D-CNN dealt with a byte sequence. Different CNNs were employed, considering the nature of different modalities.…”

Section: Introductionmentioning

confidence: 99%

Attention-Based Cross-Modal CNN Using Non-Disassembled Files for Malware Classification

2023

View full text Add to dashboard Cite

The role of malware classification is crucial in addressing the explosive increase in malware variants. By classifying malware instances into malware families, malware analysts can apply appropriate techniques and tools to handle malware variants in each family. Using high-level representations of malware, such as disassembled codes, yields meaningful classification performance. However, malware classification based on disassembled codes depends on the practically implausible assumption that every malware is correctly reversed by disassemblers. Unfortunately, sophisticated malware, which has anti-disassembly capabilities, seeks to confuse disassemblers, yielding incorrectly disassembled codes. In this study, we focus on malware family classification, which requires no disassembly, and propose a new CNN-based malware classification model using non-disassembled malware files (i.e., binary files). Our model associates two modalities: "malware images" and "structural entropies," which are converted and extracted from binary files. Both modalities have different granularities of bytes and chunks that complement each other. The model adopts a cross-modal attention mechanism to combine the features of the two modalities by moderating their expressive limitations. We validate our model using three popular datasets from the Kaggle Microsoft Malware Classification, Malimg, and BODMAS datasets. The experimental results show that our model identifies malware families with a higher degree of accuracy than previous methods and does not require the burden of disassembling.

show abstract

Section: Introductionmentioning

confidence: 99%

Attention-Based Cross-Modal CNN Using Non-Disassembled Files for Malware Classification

2023

View full text Add to dashboard Cite

show abstract

Image-Based Malware Detection Using α-Cuts and Binary Visualisation

et al. 2023

View full text Add to dashboard Cite

Image conversion of malicious binaries, or binary visualisation, is a relevant approach in the security community. Recently, it has exceeded the role of a single-file malware analysis tool and has become a part of Intrusion Detection Systems (IDSs) thanks to the adoption of Convolutional Neural Networks (CNNs). However, there has been little effort toward image segmentation for the converted images. In this study, we propose a novel method that serves a dual purpose: (a) it enhances colour and pattern segmentation, and (b) it achieves a sparse representation of the images. According to this, we considered the R, G, and B colour values of each pixel as respective fuzzy sets. We then performed α-cuts as a defuzzification method across all pixels of the image, which converted them to sparse matrices of 0s and 1s. Our method was tested on a variety of dataset sizes and evaluated according to the detection rates of hyperparameterised ResNet50 models. Our findings demonstrated that for larger datasets, sparse representations of intelligently coloured binary images can exceed the model performance of unprocessed ones, with 93.60% accuracy, 94.48% precision, 92.60% recall, and 93.53% f-score. This is the first time that α-cuts were used in image processing and according to our results, we believe that they provide an important contribution to image processing for challenging datasets. Overall, it shows that it can become an integrated component of image-based IDS operations and other demanding real-time practices.

show abstract

Classification of Malware Families Based on Efficient-Net and 1D-CNN Fusion

Cited by 2 publications

References 22 publications

Attention-Based Cross-Modal CNN Using Non-Disassembled Files for Malware Classification

Attention-Based Cross-Modal CNN Using Non-Disassembled Files for Malware Classification

Image-Based Malware Detection Using α-Cuts and Binary Visualisation

Contact Info

Product

Resources

About