Visualization Approach for Malware Classification with ResNeXt

Go, Jin Ho; Jan, Tony; Mohanty, Manoranjan; Patel, Om Prakash; Puthal, Deepak; Prasad, Mukesh

doi:10.1109/cec48606.2020.9185490

Cited by 25 publications

(8 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In this work, we use the same ResNeXt classification model, which was proposed by Xie at el. [27] in order to categorize malware families. e basic idea behind ResNeXt is to use an aggregated residual block instead of the basic residual block.…”

Section: Proposed Modelmentioning

confidence: 99%

“…e basic idea behind ResNeXt is to use an aggregated residual block instead of the basic residual block. is strategy is called "split-transformmerge," and it was implemented in the inception architecture [27].…”

Section: Proposed Modelmentioning

confidence: 99%

“…A more inclusive function, which can perform as a network itself, has been developed by Xie at el. instead of a simple aggregating transformation [27]. ey demonstrated aggregated transformations as…”

Section: Proposed Modelmentioning

confidence: 99%

“…A recent publication [27] sheds light on the advancement of malware detection through the use of the ResNeXt model. is advancement is due to the architecture of the model, which combines the features of the ResNet and InceptionNet architectures.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Modified ResNeXt for Android Malware Identification and Classification

Albahar

Elsayed

Jurcut

2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

It is critical to successfully identify, mitigate, and fight against Android malware assaults, since Android malware has long been a significant threat to the security of Android applications. Identifying and categorizing dangerous applications into categories that are similar to one another are especially important in the development of a safe Android app ecosystem. The categorization of malware families may be used to improve the efficiency of the malware detection process as well as to systematically identify malicious trends. In this study, we proposed a modified ResNeXt model by embedding a new regularization technique to improve the classification task. In addition, we present a comprehensive evaluation of the Android malware classification and detection using our modified ResNeXt. The nonintuitive malware’s features are converted into fingerprint images in order to extract the rich information from the input data. In addition, we applied fine-tuned deep learning (DL) based on the convolutional neural network (CNN) on the visualized malware samples to automatically obtain the discriminatory features that separate normal from malicious data. Using DL techniques not only avoids the domain expert costs but also eliminates the frequent need for the feature engineering methods. Furthermore, we evaluated the effectiveness of the modified ResNeXt model in the classification process by testing a total of fifteen different combinations of the Android malware image sections on the Drebin dataset. In this study, we only use grayscale malware images from a modified ResNeXt to analyze the malware samples. The experimental results show that the modified ResNeXt successfully achieved an accuracy of 98.25% using Android certificates only. Furthermore, we undertook extensive trials on the dataset in order to confirm the efficacy of our methodology, and we compared our approach with several existing methods. Finally, this article reveals the evaluation of different models and a much more precise option for malware identification.

show abstract

Section: Proposed Modelmentioning

confidence: 99%

Section: Proposed Modelmentioning

confidence: 99%

Section: Proposed Modelmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Modified ResNeXt for Android Malware Identification and Classification

Albahar

Elsayed

Jurcut

2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…Os autores aplicaram um mapa de cores com base na nova representac ¸ão visual e obtiveram 96.08 % de acurácia para seu conjunto de dados. Em [Go et al 2020], os autores usam uma rede neural baseada em ResNeXt para classificar imagens com base em malware.…”

Section: Trabalhos Relacionadosunclassified

Zero^2-SMELL: Uma nova abordagem de aprendizado zero-shot para detectar vulnerabilidades de dia zero

Barros¹,

Gomes²,

Barbosa³

et al. 2021

Anais Do XXI Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2021)

View full text Add to dashboard Cite

Um dos problemas de segurança mais relevantes é inferir se um programa tem intenções maliciosas (software malware). Mesmo que o antivírus seja uma das abordagens mais populares para detecção de malware, novos tipos de malware são lançados em um ritmo acelerado, tornando a maioria das técnicas para detectá-los rapidamente obsoletas. Portanto, o antivírus normalmente falha em detectar novos malwares até que sua assinatura seja incorporada ao banco de dados. No entanto, novas técnicas para identificar malwares desconhecidos são necessárias para proteger os sistemas mesmo no dia zero do lançamento de um malware. O aprendizado few-shot é uma abordagem que consiste em usar alguns poucos exemplos de cada classe durante o treinamento de um modelo. Um caso interessante desse tipo de abordagem é a classificação de objetos que ainda não foram usados no conjunto de treinamento, ou seja, aprendizagem Zero-shot (ZSL). No presente trabalho, propomos um novo método de ZSL para classificar malware usando representação visual. Propomos um novo espaço de representação para calcular a similaridade entre pares de objetos, denominado espaço-S. Avaliamos nossa proposta em conjuntos de dados do mundo real compostos de exemplos de malware. Nossa proposta atingiu 81 na medida Recall@K e supera outros métodos em uma proporção de 14.81% em um modelo de classificação para vulnerabilidades de dia zero.

show abstract