FastText-Based Local Feature Visualization Algorithm for Merged Image-Based Malware Classification Framework for Cyber Security and Cyber Defense

Abstract

The importance of cybersecurity has recently been increasing. A malware coder writes malware into normal executable files. A computer is more likely to be infected by malware when users have easy access to various executables. Malware is considered as the starting point for cyber-attacks; thus, the timely detection, classification and blocking of malware are important. Malware visualization is a method for detecting or classifying malware. A global image is visualized through binaries extracted from malware. The overall structure and behavior of malware are considered when global images are utilized. However, the visualization of obfuscated malware is tough, owing to the difficulties encountered when extracting local features. This paper proposes a merged image-based malware classification framework that includes local feature visualization, global image-based local feature visualization, and global and local image merging methods. This study introduces a fastText-based local feature visualization method: First, local features such as opcodes and API function names are extracted from the malware; second, important local features in each malware family are selected via the term frequency inverse document frequency algorithm; third, the fastText model embeds the selected local features; finally, the embedded local features are visualized through a normalization process. Malware classification based on the proposed method using the Microsoft Malware Classification Challenge dataset was experimentally verified. The accuracy of the proposed method was approximately 99.65%, which is 2.18% higher than that of another contemporary global image-based approach.

Mapping Tools for Open Source Intelligence with Cyber Kill Chain for Adversarial Aware Security

“…For classification, the authors used classical machine learning classifiers, such as naive Bayes and decision trees. Jang et al [14] worked on malware classification for cybersecurity and proposed an image-based malware classification algorithm that leverages local feature visualization techniques. For the local features, opcodes and API functions names that are extracted from the malware were used.…”

Visualized Malware Multi-Classification Framework Using Fine-Tuned CNN-Based Transfer Learning Models

“…Recently, extensive research on malware classification has been made by deploying the vision-based approach [6][7][8][29][30][31]. Some authors developed CNN solutions from scratch in which they did not use any pre-trained models [7,9,29,30]. In [7], the authors developed a visualized malware classification system based on Artificial Neural Network (ANN).…”

“…Besides patterns, different features could be deployed in the malware visualization process. In [30], they have included the local features in visualizing the malware application by using the FastText model. Consequently, each malware family has a unique generated local malware image since the proposed system mainly includes the local features of each malicious software.…”

Traffic Accident Detection Using Background Subtraction and CNN Encoder–Transformer Decoder in Video Frames

“…Various detection and classification models have become popular with the increase in computing power and development of neural networks [3][4][5][6][7]. These models have been applied in various fields, particularly image and video processing [8,9].…”