HIT4Mal: Hybrid image transformation for malware classification. Issue 11 (20th November 2019)

• Record Type: Journal Article
• Authors: Vu, Duc‐Ly; Nguyen, Trong‐Kha; Nguyen, Tam V.; Nguyen, Tu N.; Massacci, Fabio; Phung, Phu H.
• Is Part Of: Transactions on emerging telecommunications technologies. Volume 31:Issue 11(2020)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2019-11-20
• Subjects: Telecommunication -- Periodicals; 384.05
• DOI: 10.1002/ett.3789
• Languages: English
• ISSNs: 2161-5748

Abstract

Abstract: Modern malware evolves various detection avoidance techniques to bypass the state‐of‐the‐art detection methods. An emerging trend to deal with this issue is the combination of image transformation and machine learning models to classify and detect malware. However, existing works in this field only perform simple image transformation methods. These simple transformations have not considered color encoding and pixel rendering techniques on the performance of machine learning classifiers. In this article, we propose a novel approach to encoding and arranging bytes from binary files into images. These developed images contain statistical (eg, entropy) and syntactic artifacts (eg, strings), and their pixels are filled up using space‐filling curves. Thanks to these features, our encoding method surpasses existing methods demonstrated by extensive experiments. In particular, our proposed method achieved 93.01% accuracy using the combination of the entropy encoding and character class scheme on the Hilbert curve. Abstract : In this article, we propose a novel approach to encoding and arranging bytes from binary files into images. These developed images contain statistical (eg, entropy) and syntactic artifacts (eg, strings), and their pixels are filled up using space‐filling curves. Thanks to these features, our encoding method surpasses existing methods demonstrated by extensive experiments. In particular, our proposed method achieved 93.01% accuracy using the combination of the entropy encoding and character class scheme on the Hilbert curve.