A malware classification method based on memory dump grayscale image. (December 2018)

• Record Type: Journal Article
• Authors: Dai, Yusheng; Li, Hui; Qian, Yekui; Lu, Xidong
• Is Part Of: Digital investigation. Volume 27(2018)
• Page Start: 30
• Page End: 37
• Publication Date: 2018-12
• Subjects: Dynamic analysis -- Hardware features -- Memory dump -- Malware classification; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2018.09.006
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: Effective analysis of malware is of great significance in guaranteeing the reliability of the system operation. Malware can easily escape from existing dynamic analysis methods. Aiming at the deficiencies of current methods for detecting malware dynamically, a method of using hardware features is proposed, namely, a memory dump file is extracted and converted into a grayscale image, the image is converted into a fixed size, and the image feature is extracted using histogram of gradient, and the currently popular classifier algorithm is used to classify malware. Experiments are conducted using actual malware samples and the effectiveness of using memory dump file image is verified. This method is superior to the recently proposed hardware performance counter detection method. Highlights: Dynamic analysis technical is vulnerable to malware evasion. Using memory dumps can fully describe the malware behavior. We propose a classification method based on visual malware memory dump, which can effectively classify malware. The effectiveness of the classification method is verified by using the backdoor malware dataset.