Abstract
In the existing classification method of malware visualization, an individual static feature leads to an incomplete characterization of malware and affects classification accuracy, and the max-pooling layers in a convolutional neural network-based classification model disregard the spatial location relationships between features and loses valuable information. To overcome these drawbacks, we build a new malware classification system, DACN, which first maps the three dynamic features (i.e., API calls, DLL loads, and registry operations) of malware to the R, G, and B channels of an image respectively. Then, based on the capsule network, a malware classification model is proposed to capture the spatial location relationships between features. Experimental results demonstrate that using fused features instead of an individual feature improves the accuracy of malware classification by 1.3%–13.8%. DACN can achieve 97.5% classification accuracy, which is better than the model based on convolutional neural network.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Total malware (2021). https://www.av-test.org/en/statistics/malware/
Ibm x-force threat intelligence index (2021). https://www.ibm.com/downloads/cas/M1X3B7QG/
Moser, A., Kruegel, C., Kirda, E.: Limits of static analysis for malware detection. In: Proceedings of ACSAC, pp. 421–430 (2007)
Afianian, A., Niksefat, S., Sadeghiyan, B., Baptiste, D.: Malware dynamic analysis evasion techniques: A survey. ACM Comput. Surv. 52(6), 1–28 (2019)
Huang, N., Xu, M., Zheng, N., Qiao, T., Choo, K.K.R.: Deep android malware classification with API-based feature graph. In: Proceedings of TrustCom/BigDataSE, pp. 296–303 (2019)
Iwamoto, K., Wasaki, K.: Malware classification based on extracted API sequences using static analysis. In: Proceedings of AINTEC, pp. 31–38 (2012)
Wong, M.Y., Lie, D.: Intellidroid: A targeted input generator for the dynamic analysis of android malware. In: Proceedings of NDSS, vol. 16, pp. 21–24 (2016)
Zhang, Z., Qi, P., Wang, W.: Dynamic malware analysis with feature engineering and feature learning. In: Proceedings of AAAI, pp. 1210–1217 (2020)
Nataraj, L., Karthikeyan, S., Jacob, G., Manjunath, B.S.: Malware images: Visualization and automatic classification. In: Proceedings of VizSec, pp. 1–8. Association for Computing Machinery (2011)
Nguyen, K.D.T., Tuan, T.M., Le, S.H., Viet, A.P., Ogawa, M., Minh, N.L.: Comparison of three deep learning-based approaches for IOT malware detection. In: Proceedings of KSE, pp. 382–388 (2018)
Xiong, Y., Su, G., Ye, S., Sun, Y., Sun, Y.: Deeper capsule network for complex data. In: Proceedings of IJCNN, pp. 1–8 (2019)
Sabour, S., Frosst, N., Hinton, G.E.: Dynamic routing between capsules. In: Proceedings of NIPS, pp. 3859–3869 (2017)
Wang, Z., Han, W., Lu, Y., Xue, J.: A malware classification method based on the capsule network. In: International Conference on Machine Learning for Cyber Security, pp. 35–49. Springer (2020). https://doi.org/10.1007/978-3-030-62223-7_4
Cuckoo sandbox - automated malware analysis. https://cuckoosandbox.org/
Zhang, J., Qin, Z., Yin, H., Ou, L., Zhang, K.: A feature-hybrid malware variants detection using CNN based opcode embedding and BPNN based API embedding. Comput. Secur. 84, 376–392 (2019)
Yuan, B., Wang, J., Liu, D., Guo, W., Wu, P., Bao, X.: Byte-level malware classification based on markov images and deep learning. Comput. Secur. 92, 101740 (2020)
Naeem, H., et al.: Malware detection in industrial internet of things based on hybrid image visualization and deep learning model. Ad Hoc Netw. 105, 102154 (2020)
Yuan, Z., Lu, Y., Wang, Z., Xue, Y.: Droid-sec: Deep learning in android malware detection. In: Proceedings of SIGCOMM, pp. 371–372 (2014)
Yoo, S., Kim, S., Kim, S., Kang, B.B.: Ai-hydra: Advanced hybrid approach using random forest and deep learning for malware classification. Inf. Sci. 546, 420–435 (2021)
Wadkar, M., Di Troia, F., Stamp, M.: Detecting malware evolution using support vector machines. Expert Syst. Appl. 143, 113022 (2020)
Çayır, A., Ünal, U., Dağ, H.: Random capsnet forest model for imbalanced malware type classification task. Comput. Secur. 102(2), 102133 (2021)
Virusshare. https://virusshare.com/
Virustotal. https://www.virustotal.com/
Hu, J., Shen, L., Sun, G.: Squeeze-and-excitation networks. In: Proceedings of CVPR, pp. 7132–7141 (2018)
Radford, A., Metz, L., Chintala, S.: Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv:1511.06434 (2015)
Sebastián, S., Caballero, J.: Avclass2: Massive malware tag extraction from AV labels. In: Proceedings of ACSAC, pp. 42–53 (2020)
Krizhevsky, A., Sutskever, I., Hinton, G.E.: Imagenet classification with deep convolutional neural networks. Adv. Neural. Inf. Process. Syst. 25, 1097–1105 (2012)
Szegedy, C., et al.: Going deeper with convolutions. In: Proceedings of CVPR, pp. 1–9 (2015)
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of CVPR, pp. 770–778 (2016)
LeCun, Y.: Lenet-5, convolutional neural networks. J. Vis. Commun. Image 20(5), 14 (2015). http://yann.lecun.com/exdb/lenet
Acknowledgement
This work was supported in part by the Natural Science Foundation of Hainan Province under Grant No.621MS017, in part by the National Natural Science Foundation of China Enterprise Innovation and Development Joint Fund under Grant No.U19B2044, and in part by the Key Research and Development Project of Hainan Province under Grant No.ZDYF2020012.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Zou, B., Cao, C., Wang, L., Tao, F. (2022). DACN: Malware Classification Based on Dynamic Analysis and Capsule Networks. In: Cao, C., Zhang, Y., Hong, Y., Wang, D. (eds) Frontiers in Cyber Security. FCS 2021. Communications in Computer and Information Science, vol 1558. Springer, Singapore. https://doi.org/10.1007/978-981-19-0523-0_1
Download citation
DOI: https://doi.org/10.1007/978-981-19-0523-0_1
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-19-0522-3
Online ISBN: 978-981-19-0523-0
eBook Packages: Computer ScienceComputer Science (R0)