MCTVD: A malware classification method based on three-channel visualization and deep learning. Issue 126 (March 2023)

• Record Type: Journal Article
• Authors: Deng, Huaxin; Guo, Chun; Shen, Guowei; Cui, Yunhe; Ping, Yuan
• Is Part Of: Computers & security. Issue 126(2023)
• Publication Date: 2023-03
• Subjects: Malware classification -- Malware visualization -- Markov transfer matrix -- Deep learning -- Convolutional neural network; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.103084
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: The critical factors for the malware visualization task are analyzed. A novel malware visualization method is proposed. A malware classification method named MCTVD is proposed. Experimental results show that MCTVD performs well in Microsoft malware dataset. Abstract: With the rapid increase in the number of malware, the detection and classification of malware have become more challenging. In recent years, many malware classification methods based on malware visualization and deep learning have been proposed. However, the malware images generated by these methods do not retain the semantic and statistical properties with a small and uniform size. This article gives definitions of extracted content and filling mode to characterize the critical factors for the malware visualization task and proposes a new malware visualization method based on assembly instructions and Markov transfer matrices to characterize malware. Thus, a m alware c lassification method based on t hree-channel v isualization and d eep learning (MCTVD) is proposed. In MCTVD, its malware image has a small and uniform size, and its convolutional neural network has few convolutional and pooling layers. Experimental results show that MCTVD can achieve an accuracy of 99.44% on Microsoft's public malware dataset under 10-fold cross-validation and thus could be a highly competitive candidate for malware classification.