恶意软件检测和分类可视化技术综述

王金伟; 陈正嘉; 谢雪; 罗向阳; 马宾

doi:10.11959/j.issn.2096-109x.2023064

您当前的位置：

首页 >

文章列表页 >

恶意软件检测和分类可视化技术综述

综述 | 更新时间：2024-06-03

- 恶意软件检测和分类可视化技术综述
- Review of malware detection and classification visualization techniques
- 网络与信息安全学报 2023年9卷第5期页码：1-20
- 作者机构：
  
  1. 南京信息工程大学数字取证教育部工程研究中心，江苏南京 210044
  2. 南京信息工程大学计算机学院，江苏南京 210044
  3. 数学工程与先进计算国家重点实验室，河南郑州 450001
  4. 中国科学技术大学网络空间安全学院，安徽合肥 230031
  5. 中国航天系统科学与工程研究院，北京 100048
  6. 信息工程大学，河南郑州 450001
  7. 齐鲁工业大学网络空间安全学院，山东济南 250353
- 作者简介：
  
  [ "王金伟（1978− ），男，内蒙古呼伦贝尔人，博士，南京信息工程大学教授、博士生导师，主要研究方向为多媒体版权保护、多媒体取证、多媒体加密和数据认证" ]
  [ "陈正嘉（1999− ），男，江苏徐州人，南京信息工程大学硕士生，主要研究方向为网络安全、信息安全、恶意软件检测" ]
  [ "谢雪（1989− ），男，吉林长春人，中国科学技术大学博士生，主要研究方向为网络安全、多媒体取证" ]
  [ "罗向阳（1978− ），男，湖北荆门人，信息工程大学教授、博士生导师，主要研究方向为图像隐写和隐写分析技术" ]
  [ "马宾（1973− ），男，山东济宁人，齐鲁工业大学教授、博士生导师，主要研究方向为可逆信息隐藏、多媒体取证、隐写与隐写分析" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(62072250);国家自然科学基金;TheNational Natural Science Foundation of China(62172435);国家自然科学基金;The National Natural Science Foundation of China(U1804263);国家自然科学基金;The National Natural Science Foundation of China(U20B2065);国家自然科学基金;The National Natural Science Foundation of China(61872203);国家自然科学基金;The National Natural Science Foundation of China(71802110);国家自然科学基金;The National Natural Science Foundation of China(61802212);中原科技创新领军人才计划;Zhongyuan Science and Technology Innovation Leading Talent Project(214200510019);江苏省自然科学基金;The Jiangsu Natural Science Foundation(BK20200750);河南省网络空间态势感知重点实验室开放基金;The Open Fund of the Key Laboratory of Network Space Situation Awareness(HNTS2022002);江苏省研究生研究与实践创新项目;The Graduate Student Research and Practice Innovation Program of Jiangsu Province(KYCX200974);广东省信息安全技术重点实验室开放项目;The Open Project of Guangdong Provincial Key Laboratory of Information Security Technology(2020B1212060078);山东省计算机网络重点实验室开放课题基金;The Open Re-search Fund of Shandong Provincial Key Laboratory of Computer Networks(SDKLCN-2022-05)
- DOI：10.11959/j.issn.2096-109x.2023064
  中图分类号： TP309
- 网络首发：2023-10，
  
  纸质出版：2023-10-25
- 稿件说明：
移动端阅览
王金伟, 陈正嘉, 谢雪, 等. 恶意软件检测和分类可视化技术综述[J]. 网络与信息安全学报, 2023,9(5):1-20.

Jinwei WANG, Zhengjia CHEN, Xue XIE, et al. Review of malware detection and classification visualization techniques[J]. Chinese Journal of Network and Information Security, 2023, 9(5): 1-20.
王金伟, 陈正嘉, 谢雪, 等. 恶意软件检测和分类可视化技术综述[J]. 网络与信息安全学报, 2023,9(5):1-20. DOI： 10.11959/j.issn.2096-109x.2023064.

Jinwei WANG, Zhengjia CHEN, Xue XIE, et al. Review of malware detection and classification visualization techniques[J]. Chinese Journal of Network and Information Security, 2023, 9(5): 1-20. DOI： 10.11959/j.issn.2096-109x.2023064.

摘要

随着科技的不断发展，恶意软件及其变种的种类不断增多，已经成为网络安全的一个巨大挑战。这些恶意软件采用了多样的技术手段，以欺骗或规避传统检测方法，从而使得传统非可视化检测技术不再适用。近年来，数据可视化作为一种强有力的恶意软件检测和分类手段引起了学术界的广泛关注。通过以图像的方式呈现恶意软件的核心特征，这类方法能够显著提高恶意软件的检测和分类准确率，从而在网络安全领域具有广阔的研究前景。综述恶意软件检测领域的传统非可视化检测技术与可视化检测技术。介绍了恶意软件检测的传统非可视化方式，包括静态检测、动态检测、混合检测；重点对一些常见的恶意软件可视化方法进行了调研和综合评述，主要包括可视化结合机器学习与可视化结合深度学习两大方向，这两种方法在恶意软件检测和分类中各有优势和特点，因此在选择检测和分类方法时，需要综合考虑多个因素，包括数据集大小、计算资源和时间限制、模型准确度以及实现复杂度等；对目前检测技术所面临的问题进行了总结，并对未来的发展方向进一步展望。

Abstract

With the rapid advancement of technology

network security faces a significant challenge due to the proliferation of malicious software and its variants.These malicious software use various technical tactics to deceive or bypass traditional detection methods

rendering conventional non-visual detection techniques inadequate.In recent years

data visualization has gained considerable attention in the academic community as a powerful approach for detecting and classifying malicious software.By visually representing the key features of malicious software

these methods greatly enhance the accuracy of malware detection and classification

opening up extensive research opportunities in the field of cyber security.An overview of traditional non-visual detection techniques and visualization-based methods were provided in the realm of malicious software detection.Traditional non-visual approaches for malicious software detection

including static analysis

dynamic analysis

and hybrid techniques

were introduced.Subsequently

a comprehensive survey and evaluation of prominent contemporary visualization-based methods for detecting malicious software were undertaken.This primarily encompasses encompassed the integration of visualization with machine learning and visualization combined with deep learning

each of which exhibits distinct advantages and characteristics within the domain of malware detection and classification.Consequently

the holistic consideration of several factors

such as dataset size

computational resources

time constraints

model accuracy

and implementation complexity

is necessary for the selection of detection and classification methods.In conclusion

the challenges currently faced by detection technologies are summarized

and a forward-looking perspective on future research directions in the field is provided.

关键词

Keywords

references

国家互联网应急中心 . 网络安全信息与动态周报 [EB ] .

National Internet Emergency Center . Network security information and dynamic weekly report [EB ] .

IWAMOTO K , WASAKI K . Malware classification based on extracted API sequences using static analysis [C ] // Proceedings of the Asian Internet Engineeering Conference . 2012 : 31 - 38 .

IMRAN M , AFZAL M T , QADIR M A . Similarity-based malware classification using hidden Markov model [C ] // 2015 Fourth International Conference on Cyber Security,Cyber Warfare,and Digital Forensic (CyberSec) . 2015 : 129 - 134 .

HARDY W , CHEN L , HOU S , et al . DL4MD:a deep learning framework for intelligent malware detection [C ] // Proceedings of the International Conference on Data Science (ICDATA).The Steering Committee of The World Congress in Computer Science,Computer Engineering and Applied Computing (WorldComp) . 2016 :61.

SCHULTZ M G , ESKIN E , ZADOK F , et al . Data mining methods for detection of new malicious executables [C ] // Proceedings 2001 IEEE Symposium on Security and Privacy ( S＆P 2001) . 2000 : 38 - 49 .

KOLTER J Z , MALOOF M A . Learning to detect malicious executables in the wild [C ] // Proceedings of the 10th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2004 : 470 - 478 .

KOLTER J Z , MALOOF M A . Learning to detect and classify malicious executables in the wild [J ] . Journal of Machine Learning Research , 2006 , 7 ( 12 ).

KANG B J , YERIMA S Y , MC-LAUGHLIN K , et al . N-opcode analysis for android malware classification and categorization [C ] // 2016 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) . 2016 : 1 - 7 .

TIAN R , BATTEN L M , VERSTEEG S C . Function length as a tool for malware classification [C ] // 2008 3rd International Conference on Malicious and Unwanted Software (MALWARE) . 2008 : 69 - 76 .

SIDDIQUI M , WANG M C , LEE J . Detecting internet worms using data mining techniques [J ] . Journal of Systemics,Cybernetics and Informatics , 2009 , 6 ( 6 ): 48 - 53 .

KONG D , YAN G . Discriminant malware distance learning on structural information for automated malware classification [C ] // Proceedings of the 19th ACM SIGKDD International Conference on Knowledge Discovery and Data mining . 2013 : 1357 - 1365 .

BAYSA D , LOW R M , STAMP M . Structural entropy and metamorphic malware [J ] . Journal of Computer Virology and Hacking Techniques , 2013 , 9 ( 4 ): 179 - 192 .

LI B , ROUNDY K , GATES C , et al . Large-scale identification of malicious singleton files [C ] // Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy . 2017 : 227 - 238 .

KUMAR A , KUPPUSAMY K S , AGHILA G . A learning model to detect maliciousness of portable executable using integrated feature set [J ] . Journal of King Saud University-Computer and Information Sciences , 2019 , 31 ( 2 ): 252 - 265 .

FIRDAUSI I , ERWIN A , NUGROHO A S . Analysis of machine learning techniques used in behavior-based malware detection [C ] // 2010 2nd International Conference on Advances in Computing,Control,and Telecommunication Technologies . 2010 : 201 - 203 .

ZOLKIPLI M F , JANTAN A . An approach for malware behavior identification and classification [C ] // 2011 3rd International Conference on Computer Research and Development . 2011 : 191 - 194 .

RIECK K , TRINIUS P , WILLEMS C , et al . Automatic analysis of malware behavior using machine learning [J ] . Journal of Computer Security , 2011 , 19 ( 4 ): 639 - 668 .

ANDERSON B , QUIST D , NEIL J , et al . Graph-based malware detection using dynamic analysis [J ] . Journal in Computer Virology , 2011 , 7 ( 4 ): 247 - 258 .

KIM H , KIM J , KIM Y , et al . Improvement of malware detection and classification using API call sequence alignment and visualization [J ] . Cluster Computing , 2019 , 22 ( 1 ): 921 - 929 .

陈佳捷 , 彭伯庄 , 吴佩泽 . 基于动态行为和机器学习的恶意代码检测方法 [J ] . 计算机工程 , 2021 , 47 ( 3 ): 166 - 173 .

CHEN J J , PENG B Z , WU P Z . Malicious code detection method based on dynamic behavior and machine learning [J ] . Computer Engineering , 2021 , 47 ( 3 ): 166 - 173 .

ISLAM R , TIAN R , BATTEN L M , et al . Classification of malware based on integrated static and dynamic features [J ] . Journal of Network and Computer Applications , 2013 , 36 ( 2 ): 646 - 656 .

SANTOS I , DEVESA J , BREZO F , et al . Opem:a static-dynamic approach for machine-learning-based malware detection [C ] // International Joint Conference CISIS’12-ICEUTE´ 12-SOCO´ 12 , 2013 : 271 - 280 .

金炳初 . 基于多特征的恶意软件分类方法 [D ] . 太原:太原理工大学 , 2020 .

JIN B C . Malware classification method based on multiple features [D ] . Taiyuan:Taiyuan University of Technology , 2020 .

陈志锋 , 李清宝 , 张平 , 等 . 基于数据特征的内核恶意软件检测 [J ] . 软件学报 , 2016 , 27 ( 12 ): 3172 - 3191 .

CHEN Z F , LI Q B , ZHANG P , et al . Kernel malware detection based on data features [J ] . Journal of Software , 2016 , 27 ( 12 ): 3172 - 3191 .

NATARAJ L , KARTHIKEYAN S , JACOB G , et al . Malware images:visualization and automatic classification [C ] // Proceedings of the 8th International Symposium on Visualization for Cyber Security . 2011 : 1 - 7 .

TORRALBA A , MURPHY K P , FREEMAN W T , et al . Context-based vision system for place and object recognition [C ] // IEEE International Conference on Computer Vision . 2003 : 273 - 273 .

OLIVA A , TORRALBA A . Modeling the shape of the scene:a holistic representation of the spatial envelope [J ] . International Journal of Computer Vision , 2001 , 42 ( 3 ): 145 - 175 .

SIAGIAN C , ITTI L . Rapid biologically-inspired scene classification using features shared with visual attention [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2007 , 29 ( 2 ): 300 - 312 .

NATARAJ L , YEGNESWARAN V , PORRAS P , et al . A comparative assessment of malware classification using binary texture analysis and dynamic analysis [C ] // Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence . 2011 : 21 - 30 .

刘亚姝 , 王志海 , 严寒冰 , 等 . 抗混淆的恶意代码图像纹理特征描述方法 [J ] . 通信学报 , 2018 , 39 ( 11 ): 44 - 53 .

LIU Y S , WANG Z H , YAN H B , et al . Anti-obfuscation malicious code image texture feature description method [J ] . Journal on Communications , 2018 , 39 ( 11 ): 44 - 53 .

刘亮 , 刘露平 , 何帅 , 等 . 一种基于多特征的恶意代码家族静态标注方法 [J ] . 信息安全研究 , 2018 , 4 ( 4 ): 322 - 328 .

LIU L , LIU L P , HE S , et al . A static labeling method for malware family based on multiple features [J ] . Journal of Information Security Research , 2018 , 4 ( 4 ): 322 - 328 .

NAEEM H , GUO B , NAEEM M R , et al . Identification of malicious code variants based on image visualization [J ] . Computers ＆Electrical Engineering , 2019 , 76 : 225 - 237 .

LIU L , WANG B , YU B , et al . Automatic malware classification and new malware detection using machine learning [J ] . Frontiers of Information Technology ＆ Electronic Engineering , 2017 , 18 ( 9 ): 1336 - 1347 .

FU J , XUE J , WANG Y , et al . Malware visualization for fine-grained classification [J ] . IEEE Access , 2018 , 6 : 14510 - 14523 .

郎大鹏 , 丁巍 , 姜昊辰 , 等 . 基于多特征融合的恶意代码分类算法 [J ] . 计算机应用 , 2019 , 39 ( 8 ): 2333 - 2338 .

LANG D P , DING W , JIANG H C , et al . Malware classification algorithm based on multi-feature fusion [J ] . Journal of Computer Applications , 2019 , 39 ( 8 ): 2333 - 2338 .

李劭杰 , 王晨 , 史崯 . 基于多特征随机森林的恶意代码检测 [J ] . 计算机应用与软件 , 2020 , 37 ( 10 ): 328 - 333 .

LI S J , WANG C , SHI Y . Malware detection based on random forest with multiple features [J ] . Computer Applications and Software , 2020 , 37 ( 10 ): 328 - 333 .

ANDERSON B , STORLIE C , LANE T . Improving malware classification:bridging the static/dynamic gap [C ] // Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence . 2012 : 3 - 14 .

卢喜东 , 段哲民 , 钱叶魁 , 等 . 一种基于深度森林的恶意代码分类方法 [J ] . 软件学报 , 2020 , 31 ( 5 ): 1454 - 1464 .

LU X D , DUAN Z M , QIAN Y K , et al . A deep forest-based malware classification method [J ] . Journal of Software , 2020 , 31 ( 5 ): 1454 - 1464 .

KANCHERLA K , MUKKAMALA S . Image visualization based malware detection [C ] // 2013 IEEE Symposium on Computational Intelligence in Cyber Security (CICS) . 2013 : 40 - 44 .

DAVIS A , WOLFF M . Deep learning on disassembly data [J ] . BlackHat USA , 2015 .

轩勃娜 , 李进 . 基于改进CNN的恶意软件分类方法 [J ] . 电子学报 , 2023 , 51 ( 5 ): 1187 - 1197 .

XUAN B N , LI J . Malware classification method based on improved CNN [J ] . Acta Electronica Sinica , 2023 , 51 ( 5 ): 1187 - 1197 .

CUI Z , XUE F , CAI X , et al . Detection of malicious code variants based on deep learning [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 7 ): 3187 - 3196 .

KALASH M , ROCHAN M , MOHAMMED N , et al . Malware classification with deep convolutional neural networks [C ] // 2018 9th IFIP International Conference on New Technologies,Mobility and Security (NTMS) . 2018 : 1 - 5 .

田志成 , 张伟哲 , 乔延臣 , 等 . 基于模型解释的PE文件对抗性恶意代码检测 [J ] . 软件学报 , 2023 , 34 ( 4 ): 1926 - 1943 .

TIAN Z C , ZHANG W Z , QIAO Y C , et al . Adversarial malicious code detection for PE files based on model interpretation [J ] . Journal of Software , 2023 , 34 ( 4 ): 1926 - 1943 .

王博 , 蔡弘昊 , 苏旸 . 基于 VGGNet 的恶意代码变种分类 [J ] . 计算机应用 , 2020 , 40 ( 1 ): 162 - 167 .

WANG B , CAI H H , SU Y . Malware variant classification based on VGGNet [J ] . Journal of Computer Applications , 2020 , 40 ( 1 ): 162 - 167 .

CHU Q , LIU G , ZHU X . Visualization feature and CNN based homology classification of malicious code [J ] . Chinese Journal of Electronics , 2020 , 29 ( 1 ): 154 - 160 .

VASAN D , ALAZAB M , WASSAN S , et al . IMCFN:image-based malware classification using fine-tuned convolutional neural network architecture [J ] . Computer Networks , 2020 ,171:107138.

蒋考林 , 白玮 , 张磊 , 等 . 基于多通道图像深度学习的恶意代码检测 [J ] . 计算机应用 , 2021 , 41 ( 4 ): 1142 - 1147 .

JIANG K L , BAI W , ZHANG L , CHEN J , et al . Malware detection based on multi-channel image deep learning [J ] . Journal of Computer Applications , 2021 , 41 ( 4 ): 1142 - 1147 .

NI S , QIAN Q , ZHANG R . Malware identification using visualization images and deep learning [J ] . Computers ＆ Security , 2018 , 77 : 871 - 885 .

SUN G , QIAN Q . Deep learning and visualization for identifying malware families [J ] . IEEE Transactions on Dependable and Secure Computing , 2018 , 18 ( 1 ): 283 - 295 .

陈小寒 , 魏书宁 , 覃正泽 . 基于深度学习可视化的恶意软件家族分类 [J ] . 计算机工程与应用 , 2021 , 57 ( 22 ): 131 - 138 .

Chen X H , Wei S N , Qin Z Z . Malware family classification based on deep learning visualization [J ] . Computer Engineering and Applications , 2021 , 57 ( 22 ): 131 - 138 .

GIBERT D , MATEU C , PLANES J , et al . Classification of malware by using structural entropy on convolutional neural networks [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . 2018 :32.

XIAO G , LI J , CHEN Y , et al . MalFCS:an effective malware classification framework with automated feature extraction based on deep convolutional neural networks [J ] . Journal of Parallel and Distributed Computing , 2020 , 141 : 49 - 58 .

YAN J , QI Y , RAO Q . Detecting malware with an ensemble method based on deep neural network [J ] . Security and Communication Networks,2018 , 2018 .

乔延臣 , 姜青山 , 古亮 , 等 . 基于汇编指令词向量与卷积神经网络的恶意代码分类方法研究 [J ] . 信息网络安全 , 2019 ( 4 ): 20 - 28 .

QIAO Y C , JIANG Q S , GU L , et al . Research on malicious code classification method based on assembly instruction word vector and convolutional neural network [J ] . Information Network Security , 2019 ( 4 ): 20 - 28 .

YAKURA H , SHINOZAKI S , NISHIMURA R , et al . Neural malware analysis with attention mechanism [J ] . Computers ＆ Security , 2019 ,87:101592.

ZHAO Y , XU C , BO B , et al . Maldeep:a deep learning classification framework against malware variants based on texture visualization [J ] . Security and Communication Networks , 2019 .

任卓君 , 陈光 , 卢文科 . 恶意软件的操作码可视化方法研究 [J ] . 计算机工程与应用 , 2021 , 57 ( 18 ): 130 - 134 .

REN Z J , CHEN G , LU W K . Research on opcode visualization method for malware [J ] . Computer Engineering and Applications , 2021 , 57 ( 18 ): 130 - 134 .

REN Z , BAI T . Malware visualization based on deep learning [C ] // 2021 14th International Congress on Image and Signal Processing,BioMedical Engineering and Informatics (CISP-BMEI) . 2021 : 1 - 5 .

王润正 , 高见 , 仝鑫 . 等融合注意力机制的恶意代码家族分类研究 [J ] . 计算机科学与探索 , 2021 , 15 ( 5 ): 881 - 892 .

WANG R Z , GAO J , TONG X , et al . Research on malware family classification with attention mechanism fusion [J ] . Journal of Frontiers of Computer Science and Technology , 2021 , 15 ( 5 ): 881 - 892 .

PINHERO A , ANUPAMA M L , VINOD P , et al . Malware detection employed by visualization and deep neural network [J ] . Computers＆ Security , 2021 ,105:102247.

ANANDHI V , VINOD P , MENON V G . Malware visualization and detection using DenseNets [J ] . Personal and Ubiquitous Computing , 2021 : 1 - 17 .

HUANG X , MA L , YANG W , et al . A method for windows malware detection based on deep learning [J ] . Journal of Signal Processing Systems , 2021 , 93 : 265 - 273 .

MOUSSAS V , ANDREATOS A . Malware detection based on code visualization and two-level classification [J ] . Information , 2021 , 12 ( 3 ): 118 .

DAREM A , ABAWAJY J , MAKKAR A , et al . Visualization and deep-learning-based malware variant detection using OpCode-level features [J ] . Future Generation Computer Systems , 2021 , 125 : 314 - 323 .

CONTI M , KHANDHAR S , VINOD P . A few-shot malware classification approach for unknown family recognition using malware feature visualization [J ] . Computers ＆ Security , 2022 ,122:102887.

FALANA O J , SODIYA A S , ONASHOGA S A , et al . Mal-detect:an intelligent visualization approach for malware detection [J ] . Journal of King Saud University-Computer and Information Sciences , 2022 , 34 ( 5 ): 1968 - 1983 .

CHAGANTI R , RAVI V , PHAM T D . Image-based malware representation approach with efficient net convolutional neural networks for effective malware classification [J ] . Journal of Information Security and Applications , 2022 ,69:103306.

MALLIK A , KHETARPAL A , KUMAR S . ConRec:malware classification using convolutional recurrence [J ] . Journal of Computer Virology and Hacking Techniques , 2022 , 18 ( 4 ): 297 - 313 .

CHAUHAN D , SINGH H , HOODA H , et al . Classification of malware using visualization techniques [C ] // International Conference on Innovative Computing and Communications (ICICC 2022) . 2022 : 739 - 750 .

HAN K S , LIM J H , IM E G . Malware analysis method using visualization of binary files [M ] . Proceedings of the 2013 Research in Adaptive and Convergent Systems . 2013 : 317 - 321 .

HAN K S , LIM J H , KANG B , et al . Malware analysis using visualized images and entropy graphs [J ] . International Journal of Information Security , 2015 , 14 ( 1 ): 1 - 14 .

PATURI A , CHERUKURI M , DONAHUE J , et al . Mobile malware visual analytics and similarities of attack toolkits (malware gene analysis) [C ] // 2013 International Conference on Collaboration Technologies and Systems (CTS) . 2013 : 149 - 154 .

韩晓光 . 恶意代码检测关键技术研究 [D ] . 北京:北京科技大学 , 2015 .

HAN X G . Research on key techniques for malicious code detection [D ] . Beijing:University of Science and Technology Beijing , 2015 .

浏览量

556

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

文本摘要研究进展与趋势

基于双路特征提取和自适应融合的钓鱼网站检测

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法