A malware variants detection methodology with an opcode-based feature learning method and a fast density-based clustering algorithm. (11th February 2020)

• Record Type: Journal Article
• Authors: Yin, Hui; Zhang, Jixin; Qin, Zheng
• Is Part Of: International journal of computational science and engineering. Volume 21:Number 1(2020)
• Page Start: 19
• Page End: 29
• Publication Date: 2020-02-11
• Subjects: distance-based weight learning -- fast density-based clustering -- FDBC -- information entropy -- malware variants; Computer science -- Mathematics -- Periodicals; Computer simulation -- Mathematical aspects -- Periodicals; Computational intelligence -- Periodicals; 004.015105
• Languages: English
• ISSNs: 1742-7185

Abstract

Malware is one of the most terrible and major security threats facing the internet today, which can be defined as any type of malicious code to harm a computer or network. As malware variants can be equipped with sophisticated mechanisms to bypass traditional detection systems, in this paper, we propose a malware variant detection approach that can automatically, rapidly and accurately detect malware variants. In our approach, we present an asynchronous architecture for automated training and detection. Under this architecture, to improve the detection speed while retaining the accuracy, we propose an information entropy-based feature extraction method to extract a few but very useful features and a distance-based weight learning method to weight these features. To further improve the detection speed, we propose our fast density-based clustering algorithm. We evaluate our approach with a number of Windows-based malware instances which belong to six large families, and our experiments demonstrate that our automated malware variant detection method is able to achieve high accuracy with a significant speedup compared with the other state-of-art approaches.