MaliCage: A packed malware family classification framework based on DNN and GAN

Gao, Xudong; Hu, Changzhen; Shan, Chun; Han, Wanjiang

doi:10.1016/j.jisa.2022.103267

Cited by 5 publications

(3 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The combined feature set outperformed the single-layer feature set by 11.1% in terms of the accuracy score, as observed in the results for the random forest and other classifiers. Furthermore, we compared our work with hybrid approaches, as in [48,49], as hybrid approaches combine both static and dynamic analysis for feature extraction; our approach was superior in terms of the classification accuracy as well as in identifying unknown packers with proper dataset integrity.…”

Section: Comparing With Previous Workmentioning

confidence: 99%

Identifying Malware Packers through Multilayer Feature Engineering in Static Analysis

Alkhateeb,

Ghorbani,

Habibi Lashkari

2024

Information

View full text Add to dashboard Cite

This research addresses a critical need in the ongoing battle against malware, particularly in the form of obfuscated malware, which presents a formidable challenge in the realm of cybersecurity. Developing effective antivirus (AV) solutions capable of combating packed malware remains a crucial endeavor. Packed malicious programs employ encryption and advanced techniques to obfuscate their payloads, rendering them elusive to AV scanners and security analysts. The introduced research presents an innovative malware packer classifier specifically designed to adeptly identify packer families and detect unknown packers in real-world scenarios. To fortify packer identification performance, we have curated a meticulously crafted dataset comprising precisely packed samples, enabling comprehensive training and validation. Our approach employs a sophisticated feature engineering methodology, encompassing multiple layers of analysis to extract salient features used as input to the classifier. The proposed packer identifier demonstrates remarkable accuracy in distinguishing between known and unknown packers, while also ensuring operational efficiency. The results reveal an impressive accuracy rate of 99.60% in identifying known packers and 91% accuracy in detecting unknown packers. This novel research not only significantly advances the field of malware detection but also equips both cybersecurity practitioners and AV engines with a robust tool to effectively counter the persistent threat of packed malware.

show abstract

Section: Comparing With Previous Workmentioning

confidence: 99%

Identifying Malware Packers through Multilayer Feature Engineering in Static Analysis

Alkhateeb,

Ghorbani,

Habibi Lashkari

2024

Information

View full text Add to dashboard Cite

show abstract

“…Experimental results show that the framework is beneficial for identifying and predicting zero-day malware-like images. Gao et al (2022) proposed an efficient classification framework (MaliCage) for packaged malware. Experimental results…”

Section: Malware Identification Based On Gan Networkmentioning

confidence: 99%

Efficient Windows malware identification and classification scheme for plant protection information systems

2023

View full text Add to dashboard Cite

Due to developments in science and technology, the field of plant protection and the information industry have become increasingly integrated, which has resulted in the creation of plant protection information systems. Plant protection information systems have modernized how pest levels are monitored and improved overall control capabilities. They also provide data to support crop pest monitoring and early warnings and promote the sustainable development of plant protection networks, visualization, and digitization. However, cybercriminals use technologies such as code reuse and automation to generate malware variants, resulting in continuous attacks on plant protection information terminals. Therefore, effective identification of rapidly growing malware and its variants has become critical. Recent studies have shown that malware and its variants can be effectively identified and classified using convolutional neural networks (CNNs) to analyze the similarity between malware binary images. However, the malware images generated by such schemes have the problem of image size imbalance, which affects the accuracy of malware classification. In order to solve the above problems, this paper proposes a malware identification and classification scheme based on bicubic interpolation to improve the security of a plant protection information terminal system. We used the bicubic interpolation algorithm to reconstruct the generated malware images to solve the problem of image size imbalance. We used the Cycle-GAN model for data augmentation to balance the number of samples among malware families and build an efficient malware classification model based on CNNs to improve the malware identification and classification performance of the system. Experimental results show that the system can significantly improve malware classification efficiency. The accuracy of RGB and gray images generated by the Microsoft Malware Classification Challenge Dataset (BIG2015) can reach 99.76% and 99.62%, respectively.

show abstract

“…XianWei Gao [21] framework to categorize the malware using deep neural network (DNN) and generative adversarial network (GAN). The MaliCage is comprised with three modules such as packer detector, malware classifier and a packer.…”

Section: Related Workmentioning

confidence: 99%

Hybridized Least Absolute Shrinkage Selection Operator and Cross-Validation Algorithm for Classification of Malware

2023

IJIES

View full text Add to dashboard Cite

In recent years, the growth of malicious software is becoming high and led to a huge number of security threats. The malware exploits the system information and uses the important information of the user without any intimation. Moreover, the malware furtively directs that information to the servers which are organized by the attackers. In recent years, researchers and scientists discovered anti-malware products to identify known malware. But, these methods are not robust to detect obfuscated and packed malware. The fore mentioned issues rely on the existing approaches can be rectified using the hybridized least absolute shrinkage selection operator and cross validation (LASSO-CV) algorithm are proposed. The LASSO is used in the process of selecting the stochastic features and CV visualize the feature using weighted co-efficient approach. The effective features are selected by the LASSO-CV algorithm which eases the process of classifying the malware. This research also utilized long-short term memory (LSTM)-softsign classifier to classify the malware. The malware samples are collected from the VXHeavens and android malware dataset (AMD) dataset which consists of malware samples from various software. The classification results obtained from the LSTM-softsign classifier have better classification accuracy of 97.85% for VX heavens dataset and 99.24% for AMD.

show abstract

MaliCage: A packed malware family classification framework based on DNN and GAN

Cited by 5 publications

References 40 publications

Identifying Malware Packers through Multilayer Feature Engineering in Static Analysis

Identifying Malware Packers through Multilayer Feature Engineering in Static Analysis

Efficient Windows malware identification and classification scheme for plant protection information systems

Hybridized Least Absolute Shrinkage Selection Operator and Cross-Validation Algorithm for Classification of Malware

Contact Info

Product

Resources

About