update - Oct 2020

https://github.com/pratikpv/malware_detect2 is the extension of this research.

Transfer Learning for Image-Based Malware Classification

This is the research project we did in Fall 2018 Machine Learning class at SJSU. The full paper can be found at https://arxiv.org/abs/1903.11551 or https://www.researchgate.net/publication/330343262_Transfer_Learning_for_Image-Based_Malware_Classification

Abstract

Niket Bhodia, Pratikkumar Prajapati, Fabio Di Troia, Mark Stamp (Submitted on 21 Jan 2019)

In this paper, we consider the problem of malware detection and classification based on image analysis. We convert executable files to images and apply image recognition using deep learning (DL) models. To train these models, we employ transfer learning based on existing DL models that have been pre-trained on massive image datasets. We carry out various experiments with this technique and compare its performance to that of an extremely simple machine learning technique, namely, k-nearest neighbors (\kNN). For our k-NN experiments, we use features extracted directly from executables, rather than image analysis. While our image-based DL technique performs well in the experiments, surprisingly, it is outperformed by k-NN. We show that DL models are better able to generalize the data, in the sense that they outperform k-NN in simulated zero-day experiments.

Sample gray-scale images generated from malware executables

Fig.1 Sample images of unrelated binaries

Fig.2 Samples from a malware family

Comments

3rd International Workshop on Formal Methods for Security Engineering (ForSE 2019), in conjunction with the 5th International Conference on Information Systems Security and Privacy (ICISSP 2019), Prague, Czech Republic, February 23-25, 2019

Subjects: Machine Learning (cs.LG); Cryptography and Security (cs.CR); Machine Learning (stat.ML)