关键词: 恶意代码家族检测, 感知哈希, 图像特征, 特征融合, 机器学习

Abstract: In the current detection of the malware family, the local features or global features extracted through the grayscale image of the malware cannot fully describe the malware. Aiming at the problem and to improve the detection effect, a malware detection method based on perceptual hash algorithm and feature fusion was proposed. Firstly, the grayscale image samples of malware were detected through the perceptual hash algorithm, and samples of specific malware families and uncertain malware families were quickly divided. Experimental tests showed that about 67% malwares were able to be detected by the perceptual hash algorithm. Then, the local features of Local Binary Pattern (LBP) and global features of Gist were further extracted for the samples of uncertain families, and the features of merging the above two features were used to classify and detect the malware samples by the machine learning algorithm. Finally, experimental results of the detection of 25 types of malware families show that the detection accuracy is higher when using the fusion feature of LBP and Gist compared to that when using a single feature only, and the proposed method is more efficient in classification and detection than the detection algorithm using machine learning only with the detection speed increased by 93.5%.

Key words: malware family detection, perceptual hash, image feature, feature fusion, machine learning