Identification of malicious code variants based on image visualization. (June 2019)

• Record Type: Journal Article
• Authors: Naeem, Hamad; Guo, Bing; Naeem, Muhammad Rashid; Ullah, Farhan; Aldabbas, Hamza; Javed, Muhammad Sufyan
• Is Part Of: Computers & electrical engineering. Volume 76(2019)
• Page Start: 225
• Page End: 237
• Publication Date: 2019-06
• Subjects: Cyber security -- Feature extraction and selection -- Grayscale image -- Image visualization -- LGMP -- Malware detection -- Malware variants -- Machine learning; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2019.03.015
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: The recent increases in Internet use and the number of malicious attacks are helping attackers generate malware variants through automated software. Because of these attacks, the amount of malware and the number of their variants are continuously increasing. Consequently, an improved malware analysis is a critical requirement to stop the rapid expansion of malicious activities. In this study, we propose a more accurate and slightly faster model to characterize malware variants. To implement the proposed model, we designed a method for transforming a malware binary into a grayscale image. We then propose the use of collective local and global malicious patterns for efficient malware variant identification. To reduce the computational time, the total number of dimensions of both types of patterns is reduced using selection methods. In addition, we prepared a baseline to compare the classification performance of our proposed model with previous state-of-the-art malware detection techniques. The experimental results indicate that the response time and classification performance of our model are better than those of previous models.