MSIC: Malware Spectrogram Image Classification

Abstract

The heavy reliance on digital technology, by individuals and organizations, has reshaped the traditional economy into a digital economy. In response, cybercriminals' attention has shifted dramatically from showing off skills and conducting individual attacks into high sophisticated attacks with financial gain as the goal. This, inevitably, poses a challenge to the cybersecurity community as they strive to find solutions to preserve the confidentiality, availability and integrity of the individual users' and corporates' private data and services. Cybercriminals mainly deploy malware to achieve their goals, which could be in the form of ransomware, botnets, etc. The use of encryption, packing and polymorphism techniques makes it harder to detect the malware files, especially when these are created in great numbers every day. In this paper, a novel framework, named Malware Spectrogram Image Classification (MSIC), is proposed. It employs spectrogram images in conjunction with the convolution neural network to classify a malware file to its corresponding family and to differentiate it from a benign file. Further, this research shares with the research community two privately collected labeled malicious and benign datasets. The evaluation of MSIC showed its effectiveness to be 91.6% F-measure and 92.8% accuracy in classifying malware files to their corresponding families, in comparison to, respectively, 90.6% and 92.3% results produced by the grayscale image classification approach. Likewise, in classifying files as malicious or benign, MSIC scored 96% F-measure and accuracy results compared to 95.5% with the grayscale solution. Also, MSIC required less computational time in converting and resizing the files than the grayscale framework.

A Feature-Reduction Scheme Based on a Two-Sample t-Test to Eliminate Useless Spectrogram Frequency Bands in Acoustic Event Detection Systems

“…Azab and Khasawneh [36] used the spectrogram to detect malware files. Kachaa et al [37] analyzed the different conditions of dysarthric speech, which is a speech disorder related to muscle weakness, using the spectrogram of voice signals to interpret the different states of this disorder.…”

MS‐ADS: Multistage Spectrogram image‐based Anomaly Detection System for IoT security

“…A spectrogram is a pictorial representation of the signal's visual details. It depicts the signal's frequency with time in the form of an image by representing the magnitude of the frequency at a specific time contained in the signal by varying the color heatmaps against the vertical frequency axis to express the energy 32 . Spectrograms are very efficiently utilized in different fields, for instance, speech analysis 33 and the medical field for ECG analysis 34 .…”

“…It depicts the signal's frequency with time in the form of an image by representing the magnitude of the frequency at a specific time contained in the signal by varying the color heatmaps against the vertical frequency axis to express the energy. 32 Spectrograms are very efficiently utilized in different fields, for instance, speech analysis 33 and the medical field for ECG analysis. 34 In this study, we adopted the STFT technique for performing the time-frequency analysis to obtain the spectrogram images from the available discrete data.…”

A Deep Learning Model for Malware Multi-Class Classification based on Colored Malware Images

“…Azab et al [18] implemented a CNN-based malware classification framework that uses spectrogram images. Unlike the grayscale classification, the proposed method first converts the raw bits of the malware binaries into spectrogram images (by signals fundamentals: applying Fourier Transform visualizes malware as spectrogram images) and then feeds them to CNN.…”