Abstract
In this chapter, we consider malware classification using deep learning techniques and image-based features. We employ a wide variety of deep learning techniques, including multilayer perceptrons (MLP), convolutional neural networks (CNN), long short-term memory (LSTM), and gated recurrent units (GRU). Among our CNN experiments, transfer learning plays a prominent role—specifically, we test the VGG-19 and ResNet152 models. As compared to previous work, the results presented in this chapter are based on a larger and more diverse malware dataset, we consider a wider array of features, and we experiment with a much greater variety of learning techniques. Consequently, our results are the most comprehensive and complete that have yet been published.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Adware:win32/hotbar. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Hotbar&threatId=6204.
Austin, Thomas H., Eric Filiol, Sébastien Josse, and Mark Stamp. 2013. Exploring hidden Markov models for virus analysis: A semantic approach. In 46th Hawaii international conference on system sciences, HICSS 2013, Wailea, HI, USA, January 7–10, 2013, 5039–5048. IEEE Computer Society.
Backdoor:win32/cycbot.g. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Cycbot.G.
Backdoor:win32/zegost.ad. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FZegost.AD.
Baysa, Donabelle, Richard M. Low, and Mark Stamp. 2013. Structural entropy and metamorphic malware. Journal of Computer Virology and Hacking Techniques 9 (4): 179–192.
Bhodia, Niket, Pratikkumar Prajapati, Fabio Di Troia, and Mark Stamp. 2019. Transfer learning for image-based malware classification. https://arxiv.org/abs/1903.11551.
Carrera, Ero. 2019. pefile 2019.4.18. https://pypi.org/project/pefile/.
Damodaran, Anusha, Fabio Di Troia, Corrado Aaron Visaggio, Thomas H. Austin, and Mark Stamp. 2017. A comparison of static, dynamic, and hybrid analysis for malware detection. Journal of Computer Virology and Hacking Techniques 13 (1): 1–12.
Gupta, Arpit. 2018. Alexa blogs: How Alexa is learning to converse more naturally. https://developer.amazon.com/blogs/alexa/post/15bf7d2a-5e5c-4d43-90ae-c2596c9cc3a6/how-alexa-is-learning-to-converse-more-naturally.
Jain, Mugdha, William Andreopoulos, and Mark Stamp. 2020. Convolutional neural networks and extreme learning machines for malware classification. Journal of Computer Virology and Hacking Techniques. To appear.
Khaitan, Pranav. 2016. Google AI blog: Chat smarter with Allo. https://ai.googleblog.com/2016/05/chat-smarter-with-allo.html.
Kim, Samuel. 2018. PE header analysis for malware detection. Master’s thesis, San Jose State University. https://scholarworks.sjsu.edu/etd_projects/624/.
Levy, Steven. 2016. The iBrain is here—and it’s already inside your phone. Wired. https://www.wired.com/2016/08/an-exclusive-look-at-how-ai-and-machine-learning-work-at-apple/.
McKinney, Wes. 2020. Pandas 1.0.5: Powerful data structures for data analysis, time series, and statistics. https://pypi.org/project/pandas/.
Nappa, Antonio, M. Zubair Rafique, and Juan Caballero. 2015. The malicia dataset: identification and analysis of drive-by download operations. International Journal of Information Security 14 (1): 15–33.
Nataraj, L., S. Karthikeyan, G. Jacob, and B.S. Manjunath. 2011. Malware images: Visualization and automatic classification. In Proceedings of the 8th International Symposium on Visualization for Cyber Security, VizSec ’11.
Travis Oliphant. 2006. NumPy: A guide to NumPy. http://www.numpy.org/.
Paszke, Adam, Sam Gross, Soumith Chintala, and Gregory Chanan. 2016. PyTorch: From research to production. https://pytorch.org/.
Prajapati, Pratikkumar. 2020. Github repository. https://github.com/pratikpv/malware_detect2.
Pws:win32/delfinject. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/DelfInject&threatId=-2147241365.
Pws:win32/lolyda.bf. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS%3AWin32%2FLolyda.BF.
Pws:win32/onlinegames. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS%3AWin32%2FOnLineGames.
Pws:win32/zbot. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Zbot&threatId=-2147368817.
Simonyan, Karen, and Andrew Zisserman. 2014. Very deep convolutional networks for large-scale image recognition. https://arxiv.org/abs/1409.1556.
Singh, Tanuvir, Fabio Di Troia, Corrado Aaron Visaggio, Thomas H. Austin, and Mark Stamp. 2016. Support vector machines and malware detection. Journal of Computer Virology and Hacking Techniques 12 (4): 203–212.
Spruston, Nelson. 2019. Pyramidal neurons: Dendritic structure and synaptic integration. Nature Reviews Neuroscience 9: 206–221. https://www.nature.com/articles/nrn2286.
Stamp, Mark. 2020. A selective survey of deep learning techniques and their application to malware analysis. In Malware Analysis using Artificial Intelligence and Deep Learning, chapter 1, Stamp, Mark, Mamoun Alazab, and Andrii Shalaginov, ed. 1–48. Springer.
Toderici, Annie H., and Mark Stamp. 2013. Chi-squared distance and metamorphic virus detection. Journal of Computer Virology and Hacking Techniques 9 (1): 1–14.
Trojandownloader:win32/adload. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader%3AWin32%2FAdload.
Trojandownloader:win32/agent. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Agent&ThreatID=14992.
Trojandownloader:win32/renos. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Renos&threatId=16054.
Trojan:win32/bho. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/BHO&threatId=-2147364778.
Trojan:win32/startpage. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Startpage&threatId=15435.
Virtool:win32/ceeinject. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool%3AWin32%2FCeeInject.
Win32/alureon. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Alureon.
Win32/fakerean. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/FakeRean.
Win32/obfuscator. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Obfuscator&threatId=.
Win32/rbot. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Rbot&threatId=.
Win32/vobfus. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Vobfus&threatId=.
Win32/vundo. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Vundo&threatId=.
Win32/winwebsec. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Winwebsec.
Wong, Wing, and Mark Stamp. 2006. Hunting for metamorphic engines. Journal in Computer Virology 2 (3): 211–229.
Wu, Yonghui, Mike Schuster, Zhifeng Chen, Quoc V. Le, Mohammad Norouzi, Wolfgang Macherey, Maxim Krikun, Yuan Cao, Qin Gao, Klaus Macherey, Jeff Klingner, Apurva Shah, Melvin Johnson, Xiaobing Liu, Łukasz Kaiser, Stephan Gouws, Yoshikiyo Kato, Taku Kudo, Hideto Kazawa, Keith Stevens, George Kurian, Nishant Patil, Wei Wang, Cliff Young, Jason Smith, Jason Riesa, Alex Rudnick, Oriol Vinyals, Greg Corrado, Macduff Hughes, and Jeffrey Dean. 2016. Google’s neural machine translation system: Bridging the gap between human and machine translation. https://arxiv.org/abs/1609.08144.
Yajamanam, S., V. R. S. Selvin, F. Di Troia, and Mark Stamp. 2018. Deep learning versus gist descriptors for image-based malware classification. In Proceedings of the 4th International Conference on Information Systems Security and Privacy, ICISSP 2018, 553–561.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Appendix: Confusion Matrices
Appendix: Confusion Matrices
Confusion matrix for MLP experiment
Confusion matrix for CNN 2-d experiment
Confusion matrix for CNN 1-d experiment
Confusion matrix for opcode-based CNN experiment
Confusion matrix for GRU experiment
Confusion matrix for stacked LSTM-GRU experiment
Confusion matrix for VGG-19 experiment
Rights and permissions
Copyright information
© 2021 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this chapter
Cite this chapter
Prajapati, P., Stamp, M. (2021). An Empirical Analysis of Image-Based Learning Techniques for Malware Classification. In: Stamp, M., Alazab, M., Shalaginov, A. (eds) Malware Analysis Using Artificial Intelligence and Deep Learning. Springer, Cham. https://doi.org/10.1007/978-3-030-62582-5_16
Download citation
DOI: https://doi.org/10.1007/978-3-030-62582-5_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-62581-8
Online ISBN: 978-3-030-62582-5
eBook Packages: Computer ScienceComputer Science (R0)