Image-based malware classification using section distribution information. Issue 110 (November 2021)

• Record Type: Journal Article
• Authors: Xiao, Mao; Guo, Chun; Shen, Guowei; Cui, Yunhe; Jiang, Chaohui
• Is Part Of: Computers & security. Issue 110(2021)
• Publication Date: 2021-11
• Subjects: Malware classification -- Malware visualization -- Gray images -- Machine learning -- Deep learning; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102420
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: The section distribution information of malware is useful to classify malware. A novel malware visualization method is proposed. A malware classification method based on CoLab, VGG16, and SVM is proposed. Experimental results show that our method performs well in accuracy and F1-score. Abstract: Recently, with the rapid increase in the number of malware, the traditional machine learning-based malware classification methods are faced with the severe challenge of efficiently and accurately detecting a large number of malicious programs. To meet this challenge, malware classification based on malware image and deep learning has become an effective solution. However, it is difficult to identify the section distribution information such as the number, order, and size of sections from the current gray images converted by the binary sequences of PE files. Therefore, this article proposes a novel visualization method that introduces the Colored Label boxes (CoLab) to mark the sections of a PE file to further emphasize the section distribution information in the converted malware image. Moreover, a malware classification method called MalCVS (Malware classification using CoLab image, VGG16, and Support vector machine) is constructed. The experimental results of the malware collected from VX-Heaven and Virusshare as well as the Microsoft Malware Classification Challenge dataset showed that MalCVS can effectively classify malware into families with high accuracy. The average accuracies of MalCVS are respectively 96.59% and 98.94% on the two datasets.