Multiclass malware classification via first- and second-order texture statistics

Zhao

Security and Communication Networks

et al. 2021

With the rapid increase in the amount and type of malware, traditional methods of malware detection and family classification for IoT applications through static and dynamic analysis have been greatly challenged. In this paper, a new simple and effective attention module of Convolutional Neural Networks (CNNs), named as Depthwise Efficient Attention Module (DEAM), is proposed and combined with a DenseNet to propose a new malware detection and family classification model. Based on the good effect of the DenseNet in the field of image classification and the visual similarity of the malware family on images, the gray-scale image transformed from malware is input into the model combined with the DEAM and DenseNet for malware detection, and then the family classification is carried out. The DEAM is a general lightweight attention module improved based on the Convolutional Block Attention Module (CBAM), which can strengthen the attention to the characteristics of malware and improve the model effect. We use the MalImg dataset, Microsoft malware classification challenge dataset (BIG 2015), and our dataset constructed by the two above-mentioned datasets to verify the effectiveness of the proposed model in family classification and malware detection. Experimental results show that the proposed model achieves 99.3% in terms of accuracy for malware detection on our dataset and achieves 98.5% and 97.3% in terms of accuracy for family classification on the MalImg dataset and BIG 2015 dataset, respectively. The model can reliably detect IoT malware and classify its families.

Section: Malimg Datasetmentioning

confidence: 51%

Section: Related Workmentioning

confidence: 99%

A Novel Malware Detection and Family Classification Scheme for IoT Based on DEAM and DenseNet

Zhao

Security and Communication Networks

et al. 2021

“…Verma et al [49] suggested using a combination of the first-order and grey-level co-occurrence matrix (GLCM)-based second-order statistical texture features, which are classified using ensemble learning. The kernel-based ELM classifier was used for malware classification achieving 94.25% accuracy for the Malimg dataset.…”

Section: Related Workmentioning

confidence: 99%

Image-Based Malware Classification Using VGG19 Network and Spatial Convolutional Attention

et al. 2021

In recent years the amount of malware spreading through the internet and infecting computers and other communication devices has tremendously increased. To date, countless techniques and methodologies have been proposed to detect and neutralize these malicious agents. However, as new and automated malware generation techniques emerge, a lot of malware continues to be produced, which can bypass some state-of-the-art malware detection methods. Therefore, there is a need for the classification and detection of these adversarial agents that can compromise the security of people, organizations, and countless other forms of digital assets. In this paper, we propose a spatial attention and convolutional neural network (SACNN) based on deep learning framework for image-based classification of 25 well-known malware families with and without class balancing. Performance was evaluated on the Malimg benchmark dataset using precision, recall, specificity, precision, and F1 score on which our proposed model with class balancing reached 97.42%, 97.95%, 97.33%, 97.11%, and 97.32%. We also conducted experiments on SACNN with class balancing on benign class, also produced above 97%. The results indicate that our proposed model can be used for image-based malware detection with high performance, despite being simpler as compared to other available solutions.

“…Since malware classification is a time-sensitive component in any anti-virus product, and a small delay could miss the best opportunity to discover malware processes, the procedure for distinguishing malware samples should take short time. We measured the CPU time of our dataset passing through VisMal during the test procedure and calculated the [39] in 2018, [40] in 2019, [31] in 2020, [41] in 2020, [30] 8.…”

Section: Efficiencymentioning

confidence: 99%

Malware-on-the-Brain: Illuminating Malware Byte Codes with Images for Malware Classification

Zhong¹,

Chen²,

Xu³

et al. 2021

Preprint

Malware is a piece of software that was written with the intent of doing harm to data, devices, or people. Since a number of new malware variants can be generated by reusing codes, malware attacks can be easily launched and thus become common in recent years, incurring huge losses in businesses, governments, financial institutes, health providers, etc. To defeat these attacks, malware classification is employed, which plays an essential role in anti-virus products. However, existing works that employ either static analysis or dynamic analysis have major weaknesses in complicated reverse engineering and time-consuming tasks. In this paper, we propose a visualized malware classification framework called VisMal, which provides highly efficient categorization with acceptable accuracy. VisMal converts malware samples into images and then applies a contrast-limited adaptive histogram equalization algorithm to enhance the similarity between malware image regions in the same family. We provided a proof-of-concept implementation and carried out an extensive evaluation to verify the performance of our framework. The evaluation results indicate that VisMal can classify a malware sample within 5.2ms and have an average accuracy of 96.0%. Moreover, VisMal provides security engineers with a simple visualization approach to further validate its performance.