Malware Visualization for Fine-Grained Classification

Jian-wen, FU; Xue, Jingfeng; Wang, Yong; Liu, Zhenyan; Shan, Chun

doi:10.1109/access.2018.2805301

Cited by 97 publications

(64 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The method is similar to the proposed method, in that it uses local features with images of malware. The performance of the method proposed in this study was 2.18% better than that of the method proposed by Jianwen Fu [17]. The method proposed by Sang Ni [21] classifies malware into different families; local images are created using local features extracted from malware.…”

Section: Dataset and Experimental Environmentmentioning

confidence: 81%

“…Jianwen Fu et al generated a global image using the global features of malware along with local features [17]. They used entropy values, byte values and relative sizes of all the sections for each section from the malware-infected PE files to generate the global image; they extracted the texture and color features from this global image using the gray-level co-occurrence matrix (GLCM) and color moment.…”

Section: Local Feature-based Malware Detection or Classificationmentioning

confidence: 99%

“…Our method embeds opcodes and API function names through the fastText model and visualizes them, thereby overcoming these shortcomings to a significant extent. Jianwen Fu et al classified malware by generating a global image with the global features of malware and extracting local features from the code and data sections of malware [17]. Such extraction of local features from obfuscated malware through static analysis remains to be a difficult task.…”

Section: Local Feature-based Malware Detection or Classificationmentioning

confidence: 99%

“…Table 6 lists the accuracy of malware classification achieved by the proposed method at 99.65% accuracy for each family. The method proposed by Jianwen Fu [17] classifies malware into different families; a global image is generated using a global feature and a local feature extracted from malware. The method is similar to the proposed method, in that it uses local features with images of malware.…”

Section: Dataset and Experimental Environmentmentioning

confidence: 99%

“…However, a global image cannot capture the actual behavior of obfuscated malware. A method for combining the global image and local features was proposed to increase classification accuracy by considering actual malware behavior [17]. The application programming interface (API) and dynamic link library (DLL) information is utilized as a feature from the text section of the bytes file to extract local features.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

FastText-Based Local Feature Visualization Algorithm for Merged Image-Based Malware Classification Framework for Cyber Security and Cyber Defense

Jang

Sung

2020

Mathematics

View full text Add to dashboard Cite

The importance of cybersecurity has recently been increasing. A malware coder writes malware into normal executable files. A computer is more likely to be infected by malware when users have easy access to various executables. Malware is considered as the starting point for cyber-attacks; thus, the timely detection, classification and blocking of malware are important. Malware visualization is a method for detecting or classifying malware. A global image is visualized through binaries extracted from malware. The overall structure and behavior of malware are considered when global images are utilized. However, the visualization of obfuscated malware is tough, owing to the difficulties encountered when extracting local features. This paper proposes a merged image-based malware classification framework that includes local feature visualization, global image-based local feature visualization, and global and local image merging methods. This study introduces a fastText-based local feature visualization method: First, local features such as opcodes and API function names are extracted from the malware; second, important local features in each malware family are selected via the term frequency inverse document frequency algorithm; third, the fastText model embeds the selected local features; finally, the embedded local features are visualized through a normalization process. Malware classification based on the proposed method using the Microsoft Malware Classification Challenge dataset was experimentally verified. The accuracy of the proposed method was approximately 99.65%, which is 2.18% higher than that of another contemporary global image-based approach.

show abstract

Section: Dataset and Experimental Environmentmentioning

confidence: 81%

Section: Local Feature-based Malware Detection or Classificationmentioning

confidence: 99%

Section: Local Feature-based Malware Detection or Classificationmentioning

confidence: 99%

Section: Dataset and Experimental Environmentmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations