Abstract:Being able to detect malware variants is a critical problem due to the potential damages and the fast paces of new malware variations. According to surveys from McAfee and Symantec, there is about 69 new instances of malware detected in every minutes, and more than 50% of them are variants of existing ones. Such a large volume of diversified malware variants has forced researches to investigate new methods based on common behavior patterns using machine learning. However, such methods only use single type of features such as opcode, system call, etc., which faces several drawbacks: Firstly, the methods lose a part of useful information since different types of features show different characteristics of malware. This severely limits detection precision and recall. Secondly, the accuracy and the speed (as a trade-off) of such methods fail to meet users' expectation. Thirdly, the precise classification of malware families is still a hard problem and is also important in malware analysis. In this work, we propose a feature-hybrid malware variants detection approach which integrates multi-types of features to address these challenges. We first represent opcodes by a bi-gram model and represent API calls by a vector of frequency, then we use principal component analysis to optimize the representations to improve the convergence speed, the next we adopt a convolutional neural network and a back-propagation neural network for opcode based feature embedding and API based feature embedding respectively, and finally we embed these features to train a detection model by using softmax. Theoretical analysis and real-life experimental results show the efficiency and optimization of our approach which achieves more than 95% malware detection accuracy and almost 90% classification accuracy of malware families. The detection speed of our approach is less than 0.1 s. (C) 2019 Elsevier Ltd. All rights reserved.

Irmd: Malware Variant Detection Using Opcode Image Recognition

Malware Variant Detection Using Opcode Image Recognition with Small Training Sets

An Opcode Sequences Analysis Method for Unknown Malware Detection

A malware detection framework based on kolmogorov complexity

Malicious Code Detection Using Opcode Running Tree Representation

Detection of Malicious Code Variants Based on Deep Learning

Malware-on-the-Brain: Illuminating Malware Byte Codes with Images for Malware Classification

Control Flow-Based Opcode Behavior Analysis for Malware Detection

Detecting Malware Based on Opcode N-Gram and Machine Learning.

Malware Detection with LSTM using Opcode Language

Opcode Sequence Analysis of Android Malware by a Convolutional Neural Network.

Android Malware Detection Based on a Novel Mixed Bytecode Image Combined with Attention Mechanism

Machine-Learning-Based Malware Detection for Virtual Machine by Analyzing Opcode Sequence

Malware Homology Determination Using Visualized Images and Feature Fusion.

A Feature-Hybrid Malware Variants Detection Using CNN Based Opcode Embedding and BPNN Based API Embedding.

Deep learning-aided runtime opcode-based Windows malware detection

Deep Neural Network Based on Android Mobile Malware Detection System Using Opcode Sequences

A Malware Variants Detection Methodology with an Opcode-Based Feature Learning Method and a Fast Density-Based Clustering Algorithm

MobileNet-Based IoT Malware Detection with Opcode Features

Study of a Hybrid Approach Towards Malware Detection in Executable Files

Identification of Malicious Code Variants Based on Image Visualization