Automatic malware classification and new malware detection using machine learning

Liu LIU; Bao-sheng WANG; Bo YU; Qiu-xi ZHONG

doi:10.1631/FITEE.1601325

Your Location：

Home >

Browse articles >

Automatic malware classification and new malware detection using machine learning

Regular Papers | Updated：2022-05-19

- Automatic malware classification and new malware detection using machine learning
- 基于机器学习的自动化恶意代码分类与新恶意代码检测技术
- Frontiers of Information Technology & Electronic Engineering Vol. 18, Issue 9, Pages: 1336-1347(2017)
- Affiliations：
  
  College of Computer, National University of Defense Technology, Changsha 410073, China
- Author bio：
  
  Liu LIU, E-mail: hotmailliuliu@163.com
  [ "Bao-sheng WANG, E-mail: wbshengnudt@163.com" ]
  [ "Bo YU, E-mail: BoYUnudt@sina.com" ]
  [ "Qiu-xi ZHONG, E-mail: Qiuxizhong@163.com" ]
- Funds：
- DOI：10.1631/FITEE.1601325
  CLC： TP309.5
- Received：12 June 2016，
  
  Revised：2017-;9-15，
  
  Published：2017-09
- Accepted：
Scan QR Code
Liu LIU, Bao-sheng WANG, Bo YU, et al. Automatic malware classification and new malware detection using machine learning[J]. Frontiers of Information Technology & Electronic Engineering, 2017, 18(9): 1336-1347.
DOI：

Liu LIU, Bao-sheng WANG, Bo YU, et al. Automatic malware classification and new malware detection using machine learning[J]. Frontiers of Information Technology & Electronic Engineering, 2017, 18(9): 1336-1347. DOI： 10.1631/FITEE.1601325.

摘要

恶意软件的爆炸式增长对信息安全构成重大威胁。基于签名机制的传统反病毒系统无法将未知的恶意软件分类到相应的恶意家族和检测新的恶意软件。因此，我们提出一种基于机器学习的恶意软件分析系统，由数据处理系统，决策系统和新的恶意软件检测系统三个子系统组成。数据处理系统包含灰度图像的纹理特征，Opcode特征和API特征等三种特征提取方法。决策系统被用来分类恶意软件和证实可疑的恶意软件。最后，检测系统使用共享近邻聚类算法（shared nearest neighbor

SNN）来发现新的恶意软件。我们在Kingsoft

，ESET NOD32和Anubis收集的二万多恶意样本集上对所提出的方法进行了评估。结果表明，我们的系统可以有效地分类未知恶意软件，准确率可达98.9％。同时新恶意软件的成功检测率为86.7％。

Abstract

The explosive growth of malware variants poses a major threat to information security. Traditional anti-virus systems based on signatures fail to classify unknown malware into their corresponding families and to detect new kinds of malware programs. Therefore

we propose a machine learning based malware analysis system

which is composed of three modules: data processing

decision making

and new malware detection. The data processing module deals with gray-scale images

Opcode

-gram

and import functions

which are employed to extract the features of the malware. The decision-making module uses the features to classify the malware and to identify suspicious malware. Finally

the detection module uses the shared nearest neighbor (SNN) clustering algorithm to discover new malware families. Our approach is evaluated on more than 20 000 malware instances

which were collected by Kingsoft

ESET NOD32

and Anubis. The results show that our system can effectively classify the unknown malware with a best accuracy of 98.9%

and successfully detects 86.7% of the new malware.

关键词

Keywords

references

C. Annachhatre , , , T.H. Austin , , , M. Stamp . . Hidden Markov models for malware classification . . J. Comput. Virol.Hack. Tech. , , 2015 . . 11 ( ( 2 ): ): 59 - - 73 . . DOI: 10.1007/s11416-014-0215-x http://doi.org/10.1007/s11416-014-0215-x . .

J.Y.C. Cheng , , , T.S. Tsai , , , C.S. Yang . . An information retrieval approach for malware classification based on Windows API calls . . Int. Conf. on Machine Learning and Cybernetics , , 2013 . . p.1678 - - 1683 . . DOI: 10.1109/ICMLC.2013.6890868 http://doi.org/10.1109/ICMLC.2013.6890868 . .

A. Damodaran , , , F. di Troia , , , C.A. Visaggio , , , 等 . . A comparison of static, dynamic, and hybrid analysis for malware detection . . J. Comput. Virol. Hack. Tech. , , 2017 . . 13 ( ( 1 ): ): 1 - - 12 . . DOI: 10.1007/s11416-015-0261-z http://doi.org/10.1007/s11416-015-0261-z . .

Y.X. Ding , , , W. Dai , , , S.L. Yan , , , 等 . . Control flow-based Opcode behavior analysis for malware detection . . Comput. Secur. , , 2014 . . 44 65 - - 74 . . DOI: 10.1016/j.cose.2014.04.003 http://doi.org/10.1016/j.cose.2014.04.003 . .

M. Egele , , , T. Scholte , , , E. Kirda , , , 等 . . A survey on automated dynamic malware-analysis techniques and tools . . ACM Comput. Surv. , , 2012 . . 44 ( ( 2 ): ): Article 6 DOI: 10.1145/2089125.2089126 http://doi.org/10.1145/2089125.2089126 . .

L. Ertoz , , , M. Steinbach , , , V. Kumar . . A new shared nearest neighbor clustering algorithm and its applications . . Workshop on Clustering High Dimensional Data and Its Applications at the 2nd SIAM Int. Conf. on Data Mining , , 2002 . . p.105 - - 115 . . . .

E. Gandotra , , , D. Bansal , , , S. Sofat . . Malware analysis and classification: a survey . . J. Inform. Secur. , , 2014 . . 5 ( ( 2 ): ): 44440 DOI: 10.4236/jis.2014.52006 http://doi.org/10.4236/jis.2014.52006 . .

K.S. Han , , , J.H. Lim , , , E.G. Im . . Malware analysis method using visualization of binary files . . Proc. on Research in Adaptive and Convergent Systems , , 2013 . . p.317 - - 321 . . DOI: 10.1145/2513228.2513294 http://doi.org/10.1145/2513228.2513294 . .

Q.H. Hu , , , D.R. Yu , , , Z.X. Xie , , , 等 . . EROS: ensemble rough subspaces . . Patt. Recogn. , , 2007 . . 40 ( ( 12 ): ): 3728 - - 3739 . . DOI: 10.1016/j.patcog.2007.04.022 http://doi.org/10.1016/j.patcog.2007.04.022 . .

R. Islam , , , R.H. Tian , , , L.M. Batten , , , 等 . . Classification of malware based on integrated static and dynamic features . . J. Netw. Comput. Appl. , , 2013 . . 36 ( ( 2 ): ): 646 - - 656 . . DOI: 10.1016/j.jnca.2012.10.004 http://doi.org/10.1016/j.jnca.2012.10.004 . .

K. Iwamoto , , , K. Wasaki . . Malware classification based on extracted API sequences using static analysis . . Proc. Asian Internet Engineering Conf. , , 2012 . . p.31 - - 38 . . DOI: 10.1145/2402599.2402604 http://doi.org/10.1145/2402599.2402604 . .

S. Jain , , , Y.K. Meena . . Byte level n-gram analysis for malware detection. In : Venugopal, K.R., Patnaik, L.M. (Eds.), Computer Networks and Intelligent Computing . . Springer, Berlin , , 2011 . . p.51 - - 59 . . DOI: 10.1007/978-3-642-22786-8_6 http://doi.org/10.1007/978-3-642-22786-8_6 . .

R.A. Jarvis , , , E.A. Patrick . . Clustering using a similarity measure based on shared near neighbors . . IEEE Trans. Comput. , , 1973 . . C-22 ( ( 11 ): ): 1025 - - 1034 . . DOI: 10.1109/T-C.1973.223640 http://doi.org/10.1109/T-C.1973.223640 . .

I.T. Jolliffe . . Principal Component Analysis , , 2nd Ed : : New York Springer , , 2002 . . DOI: 10.1007/b98835 http://doi.org/10.1007/b98835 . .

K. Kancherla , , , S. Mukkamala . . Image visualization based malware detection . . IEEE Symp. on Computational Intelligence in Cyber Security , , 2013 . . p.40 - - 44 . . DOI: 10.1109/CICYBS.2013.6597204 http://doi.org/10.1109/CICYBS.2013.6597204 . .

a. kapoor , , , s. dhavale . . control flow graph based multiclass malware detection using bi-normal separation . . defen. sci. j. , , 2016 . . 66 ( ( 2 ): ): 138 - - 145 . . DOI: 10.14429/dsj.66.9701 http://doi.org/10.14429/dsj.66.9701 . .

Labs Kaspersky . . Security Bulletin 2015 , , 2015 . . https://securelist.com/files/2015/12/KSB_2015_Statistics_FINAL_EN.pdf https://securelist.com/files/2015/12/KSB_2015_Statistics_FINAL_EN.pdf , , . .

J. Kinable , , , O. Kostakis . . Malware classification based on call graph clustering . . J. Comput. Virol. , , 2011 . . 7 ( ( 4 ): ): 233 - - 245 . . DOI: 10.1007/s11416-011-0151-y http://doi.org/10.1007/s11416-011-0151-y . .

D.G. Kong , , , G.H. Yan . . Discriminant malware distance learning on structural information for automated malware classification . . Proc. 19th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining , , 2013 . . p.1357 - - 1365 . . DOI: 10.1145/2487575.2488219 http://doi.org/10.1145/2487575.2488219 . .

J. Lee , , , K. Jeong , , , H. Lee . . Detecting metamorphic malwares using code graphs . . Proc. ACM Symp. on Applied Computing , , 2010 . . p.1970 - - 1977 . . DOI: 10.1145/1774088.1774505 http://doi.org/10.1145/1774088.1774505 . .

C.T. Lin , , , N.J. Wang , , , H. Xiao , , , 等 . . Feature selection and extraction for malware classification . . J. Inform. Sci. Eng. , , 2015 . . 31 ( ( 3 ): ): 965 - - 992 . . DOI: 10.6688/JISE.2015.31.3.11 http://doi.org/10.6688/JISE.2015.31.3.11 . .

D. Lin , , , M. Stamp . . Hunting for undetectable metamorphic viruses . . J. Comput. Virol. , , 2011 . . 7 ( ( 3 ): ): 201 - - 214 . . DOI: 10.1007/s11416-010-0148-y http://doi.org/10.1007/s11416-010-0148-y . .

X.W. Liu , , , L. Wang , , , G.B. Huang , , , 等 . . Multiple kernel extreme learning machine . . Neurocomputing , , 2015 . . 149 253 - - 264 . . DOI: 10.1016/j.neucom.2013.09.072 http://doi.org/10.1016/j.neucom.2013.09.072 . .

M. Musale , , , T.H. Austin , , , M. Stamp . . Hunting for metamorphic JavaScript malware . . J. Comput. Virol. Hack. Tech. , , 2015 . . 11 ( ( 2 ): ): 89 - - 102 . . DOI: 10.1007/s11416-014-0225-8 http://doi.org/10.1007/s11416-014-0225-8 . .

L. Nataraj , , , S. Karthikeyan , , , G. Jacob , , , 等 . . Malware images: visualization and automatic classification . . Proc. 8th Int. Symp. on Visualization for Cyber Security , , 2014 . . DOI: 10.1145/2016904.2016908 http://doi.org/10.1145/2016904.2016908 . .

A. Oliva , , , A. Torralba . . Modeling the shape of the scene: a holistic representation of the spatial envelope . . Int. J. Comput. Vis. , , 2001 . . 42 ( ( 3 ): ): 145 - - 175 . . DOI: 10.1023/A:1011139631724 http://doi.org/10.1023/A:1011139631724 . .

R. Pascanu , , , J.W. Stokes , , , H. Sanossian , , , 等 . . Malware classification with recurrent networks . . IEEE Int. Conf. on Acoustics, Speech and Signal Processing , , 2015 . . p.1916 - - 1920 . . DOI: 10.1109/ICASSP.2015.7178304 http://doi.org/10.1109/ICASSP.2015.7178304 . .

K.A. Roundy , , , B.P. Miller . . Hybrid analysis and control of malware. In : Jha S., Sommer R., Kreibich, C. (Eds.), Recent Advances in Intrusion Detection . . Springer Berlin Heidelberg , , 2010 . . p.317 - - 338 . . DOI: 10.1007/978-3-642-15512-3_17 http://doi.org/10.1007/978-3-642-15512-3_17 . .

A. Russo , , , A. Sabelfeld . . Dynamic vs. static flow-sensitive security analysis . . 23rd IEEE Computer Security Foundations Symp. , , 2010 . . p.186 - - 199 . . DOI: 10.1109/CSF.2010.20 http://doi.org/10.1109/CSF.2010.20 . .

G. Salton , , , M.J. McGill . . Introduction to Modern Information Retrieval . . McGraw-Hill, Inc., New York, USA. , , 1986 . . .

A. Shabtai , , , R. Moskovitch , , , Y. Elovici , , , 等 . . Detection of malicious code by applying machine learning classifiers on static features: a state-of-the-art survey . . Inform. Secur. Tech. Rep. , , 2009 . . 14 ( ( 1 ): ): 16 - - 29 . . DOI: 10.1016/j.istr.2009.03.003 http://doi.org/10.1016/j.istr.2009.03.003 . .

H. Tao , , , X. Ma , , , M. Qiao . . Subspace selective ensemble algorithm based on feature clustering . . J. Comput. , , 2013 . . 8 ( ( 2 ): ): 509 - - 516 . . . .

R.H. Tian , , , L. Batten , , , R. Islam , , , 等 . . An automated classification system based on the strings of Trojan and virus families . . 4th Int. Conf. on Malicious and Unwanted Software , , 2009 . . p.23 - - 30 . . DOI: 10.1109/MALWARE.2009.5403021 http://doi.org/10.1109/MALWARE.2009.5403021 . .

R.H. Tian , , , R. Islam , , , L. Batten , , , 等 . . Differentiating malware from cleanware using behavioural analysis . . 5th Int. Conf. on Malicious and Unwanted Software , , 2010 . . p.23 - - 30 . . DOI: 10.1109/MALWARE.2010.5665796 http://doi.org/10.1109/MALWARE.2010.5665796 . .

K. Tsyganok , , , E. Tumoyan , , , L. Babenko , , , 等 . . Classification of polymorphic and metamorphic malware samples based on their behavior . . Proc. 5th Int. Conf. on Security of Information and Networks , , 2012 . . p.111 - - 116 . . DOI: 10.1145/2388576.2388591 http://doi.org/10.1145/2388576.2388591 . .

W. Wong , , , M. Stamp . . Hunting for metamorphic engines . . J. Comput. Virol. , , 2006 . . 2 ( ( 3 ): ): 211 - - 229 . . DOI: 10.1007/s11416-006-0028-7 http://doi.org/10.1007/s11416-006-0028-7 . .

G.H. Yan , , , N. Brown , , , D.G. Kong . . Exploring discriminatory features for automated malware classification . . In : Rieck K., Stewin P., Seifert, J.P. (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment. Springer Berlin Heidelberg , , 2013 . . p.41 - - 61 . . DOI: 10.1007/978-3-642-39235-1_3 http://doi.org/10.1007/978-3-642-39235-1_3 . .

W. Yao , , , X.Q. Chen , , , Y. Zhao , , , 等 . . Concurrent subspace width optimization method for RBF neural network modeling . . IEEE Trans. Neur. Netw. Learn. Syst. , , 2012 . . 23 ( ( 2 ): ): 247 - - 259 . . DOI: 10.1109/TNNLS.2011.2178560 http://doi.org/10.1109/TNNLS.2011.2178560 . .

Y.F. Ye , , , T. Li , , , Y. Chen , , , 等 . . Automatic malware categorization using cluster ensemble . . Proc. 16th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining , , 2010 . . p.95 - - 104 . . DOI: 10.1145/1835804.1835820 http://doi.org/10.1145/1835804.1835820 . .

Y. Yu , , , H.M. Wang , , , G. Yin , , , 等 . . Reviewer recommendation for pull-requests in GitHub: what can we learn from code review and bug assignment . . Inform. Softw. Technol. , , 2016 . . 74 204 - - 218 . . DOI: 10.1016/j.infsof.2016.01.004 http://doi.org/10.1016/j.infsof.2016.01.004 . .

Z.H. Zhou , , , J.X. Wu , , , W. Tang . . Ensembling neural networks: many could be better than all . . Artif. Intell. , , 2002 . . 137 ( ( 1-2 ): ): 239 - - 263 . . DOI: 10.1016/S0004-3702(02)00190-X http://doi.org/10.1016/S0004-3702(02)00190-X . .

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

Domain adaptation in reinforcement learning: a comprehensive and systematic study

Towards sustainable adversarial training with successive perturbation generation

Advances and challenges in artificial intelligence text generation

A disk failure prediction model for multiple issues

Data-driven soft sensors in blast furnace ironmaking: a survey

Related Author

Amirfarhad FARHADI

Mitra MIRZAREZAEE

Arash SHARIFI

Mohammad TESHNEHLAB

Wei LIN

Lichuan LIAO

Bing LI

Peng YANG

Related Institution

Department of Control Engineering, K.N. Toosi University of Technology

Department of Computer Engineering, Science and Research Branch, Islamic Azad University

Fujian Provincial Key Laboratory of Big Data Mining and Applications, Fujian University of Technology

College of Economics and Management, Xi’an University of Technology

College of Computer Science and Mathematics, Fujian University of Technology

Chat

Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
Tel：+86-571-88273162 Email：fitee@zju.edu.cn
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰