Malware classification method based on static multiple-feature fusion

Bo-wen SUN; Yan-yi HUANG; Qiao-kun WEN; Bin TIAN; Peng WU; Qi LI

doi:10.11959/j.issn.2096-109x.2017.00217

您当前的位置：

首页 >

文章列表页 >

Malware classification method based on static multiple-feature fusion

Academic paper | 更新时间：2024-06-03

- Malware classification method based on static multiple-feature fusion
- Journal of network and information security Vol. 3, Issue 11, Pages: 68-76(2017)
- 作者机构：
  
  1. 北京邮电大学网络空间安全学院天地互联与融合北京市重点实验室，北京 100876
  2. 北京邮电大学国际学院，北京 100876
  3. 中国信息安全测评中心，北京 100085
  4. 四川大学计算机学院，四川成都 610015
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00217
  CLC： TP309.5
- Online First：2017-11，
  
  Published：15 November 2017
- 稿件说明：
移动端阅览
Bo-wen SUN, Yan-yi HUANG, Qiao-kun WEN, et al. Malware classification method based on static multiple-feature fusion[J]. Journal of network and information security, 2017, 3(11): 68-76.
DOI：

Bo-wen SUN, Yan-yi HUANG, Qiao-kun WEN, et al. Malware classification method based on static multiple-feature fusion[J]. Journal of network and information security, 2017, 3(11): 68-76. DOI： 10.11959/j.issn.2096-109x.2017.00217.

摘要

近年来，恶意软件呈现出爆发式增长势头，新型恶意样本携带变异性和多态性，通过多态、加壳、混淆等方式规避传统恶意代码检测方法。基于大规模恶意样本，设计了一种安全、高效的恶意软件分类的方法，通过提取可执行文件字节视图、汇编视图、PE 视图3个方面的静态特征，并利用特征融合和分类器集成学习2种方式，提高模型的泛化能力，实现了特征与分类器之间的互补，实验证明，在样本上取得了稳定的F1-score（93.56%）。

Abstract

In recent years

the amount of the malwares has tended to rise explosively.New malicious samples emerge as variability and polymorphism.By means of polymorphism

shelling and confusion

traditional ways of detecting can be avoided.On the basis of massive malicious samples

a safe and efficient method was designed to classify the mal-wares.Extracting three static features including file byte features

assembly features and PE features

as well as im-proving generalization of the model through feature fusion and ensemble learning

which realized the complementarity between the features and the classifier.The experiments show that the sample achieve a stable F1-socre (93.56%).

关键词

Keywords

references

卡巴斯基年报 [EB/OL ] . https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ .

Kabasiji annual report [EB/OL ] . https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ https://securelist.com/kasperskysecurity-bulletin-2016-story-of-the-year/76757/ .

赛门铁克年报 [EB/OL ] . https://www.symantec.com/products/atpcontent-malware-analysis https://www.symantec.com/products/atpcontent-malware-analysis .

Symantec annual report [EB/OL ] . https://www.symantec.com/products/atp-content-malware-analysis https://www.symantec.com/products/atp-content-malware-analysis .

SCHULTZ M G , ESKIN E , ZADOK E , et al . Data mining methods for detection of new malicious executables [C ] // 2001 IEEE Sympo-sium on Security and Privacy(S＆P 2001) , 2001 : 38 - 49 .

MEHDI B , AHMED F , KHAYYAM S A , et al . Towards a Theory of Generalizing System Call Representation for In-Execution Mal-ware Detection [C ] // IEEE International Conference on Communica-tions , 2010 : 1 - 4 .

PARK Y , REEVES D , MULUKUTLA V , et al . Fast malware classi-fication by automated behavioral graph matching [C ] // AMIA Annu Symp Proc , 2010 : 1 - 4 .

SANTOS I , BREZO F , UGARTE-PEDRERO X , et al . Opcode sequences as representation of executables for data-mining-based unknown malware detection [J ] . Information Sciences , 2013 , 231 ( 9 ): 64 - 82 .

GRINI L S , SHALAGINOV A , FRANKE K . Study of soft compu-ting methods for large-scale multinomial malware types and fami-lies de-tection [C ] // The World Conference on Soft Computing , 2016 .

RIECK K , HOLZ T , WILLEMS C , et al . Learning and classifica-tion of malware behavior [C ] // The International Conference on Detection of Intrusions ＆ Malware , 2008 : 108 - 125 .

SALEHI Z , SAMI A , GHIASI M . Using feature generation from API calls for malware detection [J ] . Computer Fraud ＆ Security , 2014 , 2014 ( 9 ): 9 - 18 .

KOLOSNJAJI B , ZARRAS A , WEBSTER G ， et al . Deep learning for classi-fication of malware system call sequences [M ] // AI 2016:Advances in Artificial Intelligence . Berlin ： Springer ， 2016 .

韩晓光，曲武，姚宣霞，等 . 基于纹理指纹的恶意代码变种检测方法研究 [J ] . 通信学报， 2014 , 35 ( 8 ): 125 - 136 .

HAN X G , QU W , YAO X X , et al . Research on malicious code variants detection based on texture fingerprint [J ] . Journal on Communications . 2014 , 35 ( 8 ): 125 - 136 .

Digital bread crumbs:seven clues to identifying who's behind advanced cyber attacks [EB/OL ] . https://www.fire-eye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-digital-bread-crumbs.pdf https://www.fire-eye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-digital-bread-crumbs.pdf .

IDA pro website [EB/OL ] . https://www.hex-rays.com,accessed:27.06.2017 https://www.hex-rays.com,accessed:27.06.2017 .

PE Exeinfo website [EB/OL ] . http://exeinfo.pe.hu/,accessed:12.06.2017 http://exeinfo.pe.hu/,accessed:12.06.2017 .

Mastiff website [EB/OL ] . https://github.com/KoreLogicSecurity/mastiff,accessed:27.06.2017 https://github.com/KoreLogicSecurity/mastiff,accessed:27.06.2017 .

Yara-rules website [EB/OL ] . https://github.com/Yara-Rules/rules https://github.com/Yara-Rules/rules .

Top maliciously used APIs [EB/OL ] . https://www.bnxnet.com/wp-content/uploads/2015/01/malware_APIs.pdf.-- https://www.bnxnet.com/wp-content/uploads/2015/01/malware_APIs.pdf.-- .

Scikit-learn website [EB/OL ] . https://github.com/scikit-learn/sci-kit-learn https://github.com/scikit-learn/sci-kit-learn .

VirusShare website [EB/OL ] . https://virusshare.com/ https://virusshare.com/ .

Naming scheme-caro-computer antivirus research organization [EB/OL ] . www.caro.org/naming/scheme.html www.caro.org/naming/scheme.html .

Free online virus,malware and url scanner [EB/OL ] . https://www.virustotal.com/ https://www.virustotal.com/ .

Views

8065

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on host malcode detection using machine learning

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Personal data privacy protection method based onvertical partitioning

Related Author

Dong ZHANG

Yao ZHANG

Gang LIU

Gui-xiang SONG

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

School of Medical Information, Wannan Medical College

School of Physics and Electronic Information, Anhui Normal University

⁰