research-article

Malware images: visualization and automatic classification

Authors:

S. Karthikeyan,

B. S. ManjunathAuthors Info & Claims

VizSec '11: Proceedings of the 8th International Symposium on Visualization for Cyber Security

Article No.: 4, Pages 1 - 7

https://doi.org/10.1145/2016904.2016908

Published: 20 July 2011 Publication History

Abstract

We propose a simple yet effective method for visualizing and classifying malware using image processing techniques. Malware binaries are visualized as gray-scale images, with the observation that for many malware families, the images belonging to the same family appear very similar in layout and texture. Motivated by this visual similarity, a classification method using standard image features is proposed. Neither disassembly nor code execution is required for classification. Preliminary experimental results are quite promising with 98% classification accuracy on a malware database of 9,458 samples with 25 different malware families. Our technique also exhibits interesting resilience to popular obfuscation techniques such as section encryption.

References

[1]

Symantec Global Internet Security Threat Report, April 2010.

[2]

Anubis: Analyzing Unknown Binaries, < http://anubis.iseclab.org/>

[3]

Yoo, I. Visualizing Windows Executable Viruses Using Self-Organizing Maps., 2004 International Workshop on Visualization for Cyber Security (VizSec).

Digital Library

[4]

Quist, D. A. and Liebrock, L. M. 2009. Visualizing compiled executables for malware analysis. International Workshop on Visualization for Cyber Security (VizSec), 27--32.

[5]

Trinius, P. Holz, T. Gobel, J. and Freiling, F. C. 2009. Visual analysis of malware behavior using treemaps and thread graphs. In International Workshop on Visualization for Cyber Security (VizSec), 33--38.

[6]

Goodall, J, H. Randwan H. and Halseth, L. 2010. Visual analysis of code Security. In International Workshop on Visualization for Cyber Security (VizSec).

Digital Library

[7]

Conti, G. Bratus, S. Sangster, B. Ragsdale, S. Supan, M. Lichtenberg, A. Perez, R. and Shubina, A. 2010. Automated Mapping of Large Binary Objects Using Primitive Fragment Type Classification Digital Forensics Research Conference (DFRWS)

[8]

Conti, G. and Bratus, S. 2010. Voyage of the Reverser: A Visual Study of Binary Species, Black Hat USA.

[9]

Conti, G. Bratus, S. Shubina, A. Lichtenberg, A. Ragsdale, R. Perez-Alemany, R. Sangster, B. and Supan, M. 2010. A Visual Study of Binary Fragment Types Black Hat USA.

[10]

Multi-dimensional Scaling, Dr Toolbox http://homepage.tudelft.nl/19j49/Matlab_Toolbox_for_Dimensionality_Reduction.html

[11]

Torralba, A. Murphy, K. P. Freeman, W. T. and Rubin, M. A. 2003, Context-based vision systems for place and object recognition, Intl. Conf. on Computer Vision (ICCV).

Digital Library

[12]

Oliva, A. and Torralba. A, 2001. Modeling the shape of a scene: a holistic representation of the spatial envelope, International Journal of Computer Vision, Vol. 42(3), 145--175.

Digital Library

[13]

Karim, M. E., Walenstein, A., Lakhotia, A. & Parida, L. 2005. Malware phylogeny generation using permutations of code. Journal in Computer Virology, 1 (1):13--23.

[14]

Kolter, J. Z. and Maloof, M. A. 2004. Learning to detect malicious executables in the wild. International Conference on Knowledge Discovery and Data Mining, 470--478.

Digital Library

[15]

Gao, D., Reiter, M. K. & Song, D. 2008. Binhunt: Automatically finding semantic differences in binary programs. Information and Communications Security, 5308:238--255,

Digital Library

[16]

Tian, R. Batten, L. M. and Versteeg. S. C. 2008. Function length as a tool for malware classification. 3rd International Conference on Malicious and Unwanted Software (MALWARE),.

[17]

Tian, R. Batten, L. Islam, R. and Versteeg, S. 2009 An automated classification system based on the strings of trojan and virus families. 4rd International Conference on Malicious and Unwanted Software: MALWARE 2009, pages 23--30.

[18]

Islam, R., Tian R., Batten, L., Versteeg, S. 2010 Classification of Malware Based on String and Function Feature Selection. 2 ^nd Cybercrime and Trustworthy Computing Workshop.

Digital Library

[19]

Gheorghescu, M. 2005 An automated virus classification system. Virus Bulletin Conference, 294--300.

[20]

Park, Y. Reeves, D. Mulukutla, V. Sundaravel, B. 2010. Fast malware classification by automated behavioral graph matching, Proc. Of Sixth Annual Workshop on Cyber Security and Information Intelligent Research (CSIIRW' 10), 2010.

Digital Library

[21]

Bailey, M. Oberheide, J. Andersen, J.Mao, Z. M. Jahanian, F. and Nazario, J. 2007 Automated classification and analysis of internet malware. RAID, 4637:178--197.

Digital Library

[22]

Bayer, U. Milani Comparetti, P. Hlauschek, C. Kruegel, C. and Kirda, E. 2009. Scalable, behavior-based malware clustering. NDSS'09 Security Symposium, 2009.

[23]

Lee, T. and Mody, J. J. 2006. Behavioral classification. EICAR 2006.

[24]

Rieck, K. Holz, T. Willems, C. Dussel, P. and Laskov, P. Learning and classification of malware behavior. 2008. Fifth Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA'08), pages 108--125.

Digital Library

[25]

Li. P, Liu. L, Gao. D, Reiter. M, 2010. On Challenges in evaluating malware clustering, Proc. RAID'10

Digital Library

[26]

Microsoft Malware Enclyopedia, <http://www.microsoft.com/security/portal/Threat/Encyclopedia/Browse.aspx>

[27]

Tuceryan, M. and Jain, A. K. 1998. Texture Analysis, In The Handbook of Pattern Recognition and Computer Vision (2 ^nd Edition), pp. 207--248.

Digital Library

[28]

Brodatz, P., Textures: A Photographic Album for Artists and Designers. New York, Dover Publications, 1966.

[29]

Krejdl M. Inside Win32:Allaple -- Avast Blog. <http://blog.avast.com/2009/05/22/inside-win32allaple/>

[30]

Malware Images. <http://vision.ece.ucsb.edu/~lakshman/malware_images/album/>

Cited By

Salas MDe Geus P(2024)Deep Learning Applied to Imbalanced Malware Datasets ClassificationJournal of Internet Services and Applications10.5753/jisa.2024.390715:1(342-359)Online publication date: 16-Sep-2024
https://doi.org/10.5753/jisa.2024.3907
Kc BSapkota SAdhikari A(2024)Generative Adversarial Networks in Anomaly Detection and Malware Detection: A Comprehensive SurveyAdvances in Artificial Intelligence Research10.54569/aair.1442665Online publication date: 30-Aug-2024
https://doi.org/10.54569/aair.1442665
Omar M(2024)Revolutionizing Malware DetectionInnovations, Securities, and Case Studies Across Healthcare, Business, and Technology10.4018/979-8-3693-1906-2.ch011(196-220)Online publication date: 12-Apr-2024
https://doi.org/10.4018/979-8-3693-1906-2.ch011
Show More Cited By

Index Terms

Malware images: visualization and automatic classification

Recommendations

Malware analysis method using visualization of binary files
RACS '13: Proceedings of the 2013 Research in Adaptive and Convergent Systems

Malware authors have been generating and disseminating malware variants through various ways, such as reusing modules or using automated malware generation tools. With the help of the malware generation techniques, the number of malware keeps increasing ...
Malware analysis using visualized images and entropy graphs

Today, along with the development of the Internet, the number of malicious software, or malware, distributed especially for monetary profits, is exponentially increasing, and malware authors are developing malware variants using various automated tools ...
A few-shot malware classification approach for unknown family recognition using malware feature visualization
Abstract
With the ever-increasing threat of malware attacks, building an effective malware classifier to detect malware promptly is of utmost importance. Malware visualization approaches and deep learning techniques have proven effective in ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

VizSec '11: Proceedings of the 8th International Symposium on Visualization for Cyber Security

July 2011

51 pages

ISBN:9781450306799

DOI:10.1145/2016904

Copyright © 2011 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 20 July 2011

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Office of Naval Research

Conference

VizSec '11

VizSec '11: 2011 International Symposium on Visualization for Cyber Security

July 20, 2011

Pennsylvania, Pittsburgh, USA

Acceptance Rates

VizSec '11 Paper Acceptance Rate 6 of 11 submissions, 55%;

Overall Acceptance Rate 39 of 111 submissions, 35%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

765
Total Citations
View Citations
6,708
Total Downloads

Downloads (Last 12 months)827
Downloads (Last 6 weeks)54

Reflects downloads up to 23 Sep 2024

Other Metrics

View Author Metrics

Citations

Cited By

Salas MDe Geus P(2024)Deep Learning Applied to Imbalanced Malware Datasets ClassificationJournal of Internet Services and Applications10.5753/jisa.2024.390715:1(342-359)Online publication date: 16-Sep-2024
https://doi.org/10.5753/jisa.2024.3907
Kc BSapkota SAdhikari A(2024)Generative Adversarial Networks in Anomaly Detection and Malware Detection: A Comprehensive SurveyAdvances in Artificial Intelligence Research10.54569/aair.1442665Online publication date: 30-Aug-2024
https://doi.org/10.54569/aair.1442665
Omar M(2024)Revolutionizing Malware DetectionInnovations, Securities, and Case Studies Across Healthcare, Business, and Technology10.4018/979-8-3693-1906-2.ch011(196-220)Online publication date: 12-Apr-2024
https://doi.org/10.4018/979-8-3693-1906-2.ch011
Wu WPeng HZhu HZhang D(2024)CSMC: A Secure and Efficient Visualized Malware Classification Method Inspired by Compressed SensingSensors10.3390/s2413425324:13(4253)Online publication date: 30-Jun-2024
https://doi.org/10.3390/s24134253
Basak MHan M(2024)CyberSentinel: A Transparent Defense Framework for Malware Detection in High-Stakes Operational EnvironmentsSensors10.3390/s2411340624:11(3406)Online publication date: 25-May-2024
https://doi.org/10.3390/s24113406
Xiang XLiu HZeng LZhang HGu Z(2024)IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion DataMathematics10.3390/math1209136412:9(1364)Online publication date: 30-Apr-2024
https://doi.org/10.3390/math12091364
Garg UKumar SMahanti A(2024)IMTIBOT: An Intelligent Mitigation Technique for IoT BotnetsFuture Internet10.3390/fi1606021216:6(212)Online publication date: 17-Jun-2024
https://doi.org/10.3390/fi16060212
Al-Masri BBakir NEl-Zaart ASamrouth K(2024)Dual Convolutional Malware Network (DCMN): An Image-Based Malware Classification Using Dual Convolutional Neural NetworksElectronics10.3390/electronics1318360713:18(3607)Online publication date: 11-Sep-2024
https://doi.org/10.3390/electronics13183607
Kim HKim M(2024)Malware Detection and Classification System Based on CNN-BiLSTMElectronics10.3390/electronics1313253913:13(2539)Online publication date: 28-Jun-2024
https://doi.org/10.3390/electronics13132539
Zhang YJiang JYi CLi HMin SZuo RAn ZYu Y(2024)A Robust CNN for Malware Classification against Executable Adversarial AttackElectronics10.3390/electronics1305098913:5(989)Online publication date: 5-Mar-2024
https://doi.org/10.3390/electronics13050989
Show More Cited By

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents