Abstract:Mobile applications have been deeply integrated into the daily life of ordinary users. Android malware seriously threatens the privacy and property security of users. However, code obfuscation and other technologies have reduced the effectiveness of traditional static analysis methods, and more and more studies are extracting grayscale image features for malware detection. We propose a classification method for Android malware based on a novel mixed bytecode image and deep neural network combined with attention mechanism. Firstly, for the executable file of the target malware, read one character every 8 bits, fix the line and width, and output it as a vector. Each element in this vector is between 0 and 255, which is the range of values for grayscale images. Furthermore, the executable files are generated into grayscale images and Markov images, respectively. Then a new texture feature space is constructed by the fusion of grayscale and Markov images using the transfer probability, which is mapped to a two-dimensional space to obtain the mixed image feature. The constructed fusion feature space can more clearly characterize Android malware. What is more, the convolutional attention mechanism is added to ResNet to increase the depth of the network and improve the network effect. Finally, experiments are performed on Drebin and CICMalDroid 2020. Our experimental results show that our method can efficiently perform uniform representation of bytecode sequence files and extract and classify feature sequences. On the basis of mixed image features, the accuracy of malware detection can reach 98.67%, which outperforms the classification based on Markov images, grayscale images and other similar methods.

Malware Variant Detection Using Opcode Image Recognition with Small Training Sets

A malware detection framework based on kolmogorov complexity

Detection of Malicious Code Variants Based on Deep Learning

Malicious Code Detection Using Opcode Running Tree Representation

Malware Detection with LSTM using Opcode Language

Control Flow-Based Opcode Behavior Analysis for Malware Detection

Malware-on-the-Brain: Illuminating Malware Byte Codes with Images for Malware Classification

Deep learning-aided runtime opcode-based Windows malware detection

Android Malware Detection Based on a Novel Mixed Bytecode Image Combined with Attention Mechanism

Malware Detection Using Frequency Domain-Based Image Visualization and Deep Learning

Study of a Hybrid Approach Towards Malware Detection in Executable Files

Detecting Malware Variants Via Function-Call Graph Similarity

Interpretable Detection of Malicious Behavior in Windows Portable Executables Using Multi-Head 2D Transformers

Metamorphic Malware Detection Using Linear Discriminant Analysis and Graph Similarity

Adversarial Deep Learning for Robust Detection of Binary Encoded Malware

A Novel Malware Detection System Based On Machine Learning and Binary Visualization

MalOSDF: An Opcode Slice-Based Malware Detection Framework Using Active and Ensemble Learning

A hybrid deep learning image-based analysis for effective malware detection

Malware Detection Using Ensemble N-gram Opcode Sequences

MobileNet-Based IoT Malware Detection with Opcode Features

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files