The proliferation of malware variants, fuelled by sophisticated packaging, polymorphism and emulation techniques, has escalated the threat to Internet security. These evolving malware variants are often able to evade traditional detection methods and render them ineffective. Visualisation techniques are able to present complex data in an intuitive manner, and thus have become a promising tool in the field of malware analysis. However, current deep learning-based visualisation techniques tend to suffer from texture feature variations during the pre-processing phase, thus limiting their effectiveness when dealing with complex malware samples. To address this challenge, our research proposes a novel visualisation-based approach for lightweight and fast malware classification for the Windows platform. This approach utilises pixel-filling techniques to mitigate the variation of texture features during preprocessing and incorporates modular design principles to improve the saliency of key features. Experimental results demonstrate the superiority of our approach, achieving 99.14% accuracy on the widely used Malimg dataset, outperforming existing methods.
To cope with the escalating malicious code variants, we propose a malicious code classification method (BiTCN-CA) based on bidirectional temporal convolution network (BiTCN) and channel attention (Channel Attention (CA) based malicious code classification method (BiTCN-CA). The method fuses malicious code opcode and bytecode features to show different details; and builds BiTCN models to take advantage of the backward and forward dependencies of the features; and introduces the channel attention mechanism to further explore the deep dependencies within the malicious code data. The model is validated on kaggle dataset, and the experimental results show that the classification accuracy of malicious code based on BiTCN-CA can reach 99.36% with fast convergence speed and low classification error, and finally the effectiveness of the model is proved by comparison experiment and ablation experiment.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.