Malicious code classification algorithm based on multi-feature fusion

doi:10.11772/j.issn.1001-9081.2019010116

Journal of Computer Applications ›› 2019, Vol. 39 ›› Issue (8): 2333-2338.DOI: 10.11772/j.issn.1001-9081.2019010116

• Cyber security • Previous Articles Next Articles

Malicious code classification algorithm based on multi-feature fusion

LANG Dapeng^1,2, DING Wei¹, JIANG Haocheng¹, CHEN Zhiyuang¹

1. College of Computer Science and Technology, Harbin Engineerning University, Harbin Heilongjiang 150001, China;
2. Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China

Received:2019-01-16 Revised:2019-04-17 Online:2019-08-10 Published:2019-04-24
Supported by:
This work is partially supported by the Open Project of Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences (10201050201).

基于多特征融合的恶意代码分类算法

郎大鹏^1,2, 丁巍¹, 姜昊辰¹, 陈志远¹

1. 哈尔滨工程大学计算机科学与技术学院, 哈尔滨 150001;
2. 中国科学院信息工程研究所中国科学院网络测评技术重点实验室, 北京 100093

通讯作者: 丁巍
作者简介:郎大鹏(1983-),男,黑龙江哈尔滨人,讲师,博士,主要研究方向:信息安全;丁巍(1995-),男,湖南邵阳人,硕士研究生,主要研究方向:信息安全;姜昊辰(1994-),男,黑龙江哈尔滨人,硕士研究生,主要研究方向:信息安全;陈志远(1978-),男,黑龙江哈尔滨人,讲师,博士,主要研究方向:数字建模、水利水电工程。
基金资助:
中国科学院信息工程研究所中国科学院网络测评技术重点实验室开放课题资助项目（10201050201）。

Abstract

Abstract: Concerning the fact that most malicious code classification researches are based on family classification and malicious and benign code classification, and the classification of categories is relatively few, a malicious code classification algorithm based on multi-feature fusion was proposed. Three sets of features extracted from texture maps and disassembly files were used for fusion classification research. Firstly, the gray level co-occurrence matrix features were extracted from source files and disassembly files and the sequences of operation codes were extracted by n-gram algorithm. Secondly, the improved Information Gain (IG) algorithm was used to extract the operation code features. Thirdly, Random Forest (RF) was used as the classifier to learn the multi-group features after normalization. Finally, the random forest classifier based on multi-feature fusion was realized. The proposed algorithm achieves 85% accuracy by learning and testing nine types of malicious codes. Compared with random forest under single feature, multi-layer perceptron under multi-feature and Logistic regression classifier, it has higher accuracy.

Key words: malicious code, texture feature, opcode sequence, Random Forest (RF), static analysis

摘要： 针对多数恶意代码分类研究都基于家族分类和恶意、良性代码分类，而种类分类比较少的问题，提出了多特征融合的恶意代码分类算法。采用纹理图和反汇编文件提取3组特征进行融合分类研究，首先使用源文件和反汇编文件提取灰度共生矩阵特征，由n-gram算法提取操作码序列；然后采用改进型信息增益（IG）算法提取操作码特征，其次将多组特征进行标准化处理后以随机森林（RF）为分类器进行学习；最后实现了基于多特征融合的随机森林分类器。通过对九类恶意代码进行学习和测试，所提算法取得了85%的准确度，相比单一特征下的随机森林、多特征下的多层感知器和Logistic回归算法分类器，准确率更高。

关键词: 恶意代码, 纹理特征, 操作码序列, 随机森林, 静态分析

CLC Number:

TP309

LANG Dapeng, DING Wei, JIANG Haocheng, CHEN Zhiyuang. Malicious code classification algorithm based on multi-feature fusion[J]. Journal of Computer Applications, 2019, 39(8): 2333-2338.

郎大鹏, 丁巍, 姜昊辰, 陈志远. 基于多特征融合的恶意代码分类算法[J]. 计算机应用, 2019, 39(8): 2333-2338.

References

[1] 王洋,单征,赵炳麟,等基于静态行为轨迹的异常特征检测技术[J].计算机应用研究,2017,34(8):2434-2438. (WANG Y, SHAN Z, ZHAO B L, et al. Anomaly feature detection technology based on static behavior trajectories[J]. Application Research of Computers, 2017, 34(8):2434-2438.)
[2] SCHULTZ M, ESKIN E,ZADOK E, et al. Data mining methods for detection of new malicious executables[C]//Proceedings of the 2001 IEEE Symposium on Research in Security and Privacy. Piscataway, NJ:IEEE, 2001:38-49.
[3] CHRISTODORESCU M, JHA S, SESHIA S A, et al. Semantics-aware malware detection[C]//Proceedings of the 2005 IEEE Symposium on Security and Privacy. Piscataway, NJ:IEEE, 2005:32-46.
[4] KOLTER J Z, MALOOF M A. Learning to detect and classify maliciousexecutables in the wild[J]. Journal of Machine Learning Research, 2006, 7(1):2721-2744.
[5] NATARAJ L, KARTHIKEYAN S, JACOB G, et al. Malware images:visualization and automatic classification[C]//Proceedings of the 8th International Symposium on Visualization for Cyber Security. New York:ACM, 2011:No.4.
[6] 韩晓光,曲武,姚宣霞,等.基于纹理指纹的恶意代码变种检测方法研究[J].通信学报,2014,35(8):125-136. (HAN X G, QU W, YAO X X, et al. Research on malicious code variant detection method based on texture fingerprint[J]. Journal on Communications, 2014, 35(8):125-136.)
[7] BINDOG. GitHub[EB/OL].[2018-08-18]. https://github.com/bindog/ToyMalwareClassification/.
[8] ZHANG F, ZHAO T. Malware detection and classification based on n-grams attribute similarity[C]//Proceedings of 2017 IEEE International Conference on Computational Science and Engineering and IEEE International Conference on Embedded and Ubiquitous Computing. Washington, DC:IEEE Computer Society, 2017:793-796.
[9] KWON I, IM E G. Extracting the representative API call patterns of malware families using recurrent neural network[C]//Proceedings of the 2017 International Conference on Research in Adaptive and Convergent Systems. New York:ACM, 2017:202-207.
[10] FU J, XUE J, WANG Y, et al. Malware visualization for fine-grained classification[J]. IEEE Access, 2018, 6:14510-14523.
[11] DING Y, ZHU S. Malware detection based on deep learning algorithm[J]. Neural Computing and Applications, 2017, 31(2):461-472.
[12] 李雪虎,王发明,战凯.基于大样本的随机森林恶意代码检测与分类算法[J].信息技术与网络安全,2018,37(7):3-5,21. (LI X H, WANG F M, ZHAN K. Large sample-based random forest malicious code detection and classification algorithm[J]. Information Technology and Network Security, 2018, 37(7):3-5,21.)
[13] 潘良敏.基于GIST全局特征的钓鱼网站聚类算法研究[D].长沙:中南林业科技大学,2018:1-58. (PAN L M. Research on phishing website clustering algorithm based on the global characteristics of GIST[D]. Changsha:Central South University of Forestry and Technology, 2018:1-58.)
[14] OLIVA A, TORRALBA A. Modeling the shape of the scene:a holistic representation of the spatial envelope[J].International Journal of Computer Vision,2001,42(3):145-175.
[15] 戴逸辉,殷旭东.基于随机森林的恶意代码检测[J].网络空间安全,2018,9(2):70-75. (DAI Y H, YIN X D. Malicious code detection based on random forest[J]. Cyberspace Security, 2018,9(2):70-75.)

Malicious code classification algorithm based on multi-feature fusion

基于多特征融合的恶意代码分类算法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	JIANG Kaolin, BAI Wei, ZHANG Lei, CHEN Jun, PAN Zhisong, GUO Shize. Malicious code detection based on multi-channel image deep learning [J]. Journal of Computer Applications, 2021, 41(4): 1142-1147.
[2]	ZHANG Zenghui, JIANG Gaoxia, WANG Wenjian. Label noise filtering method based on local probability sampling [J]. Journal of Computer Applications, 2021, 41(1): 67-73.
[3]	ZHOU Xiang, ZHAI Junhai, HUANG Yajie, SHEN Ruicai, HOU Yingzhen. Instance selection algorithm for big data based on random forest and voting mechanism [J]. Journal of Computer Applications, 2021, 41(1): 74-80.
[4]	YU Yingdong, YANG Yi, LIN Lan. Image style transfer network based on texture feature analysis [J]. Journal of Computer Applications, 2020, 40(3): 638-644.
[5]	CHEN Yu, MAO Yingchi. Automatic tuning of Ceph parameters based on random forest and genetic algorithm [J]. Journal of Computer Applications, 2020, 40(2): 347-351.
[6]	WANG Bo, CAI Honghao, SU Yang. Classification of malicious code variants based on VGGNet [J]. Journal of Computer Applications, 2020, 40(1): 162-167.
[7]	LIU Yuzhen, JIANG Zhengquan, ZHAO Na. Three dimensional palmprint recognition based on neighbor ternary pattern and collaborative representation [J]. Journal of Computer Applications, 2019, 39(6): 1690-1695.
[8]	YANG Ping, ZHAO Bing, SHU Hui. Malicious code detection method based on icon similarity analysis [J]. Journal of Computer Applications, 2019, 39(6): 1728-1734.
[9]	HU Miao, WANG Kaijun. Random forest based on double features and relaxation boundary for anomaly detection [J]. Journal of Computer Applications, 2019, 39(4): 956-962.
[10]	BU Tongtong, CAO Tianjie. Risk assessment method of Android application based on permission [J]. Journal of Computer Applications, 2019, 39(1): 131-135.
[11]	WENG Liguo, LIU Wan'an, SHI Bicheng, XIA Min. Cloud/Snow classification based on multi-dimensional multi-grained cascade forest in plateau region [J]. Journal of Computer Applications, 2018, 38(8): 2218-2223.
[12]	WANG Jiaqing, ZHU Yan, CHEN Tung-shou, CHANG Chin-chen. Optimum feature selection based on genetic algorithm under Web spam detection [J]. Journal of Computer Applications, 2018, 38(1): 295-299.
[13]	SU Zhida, ZHU Yuefei, LIU Long. Android malware application detection using deep learning [J]. Journal of Computer Applications, 2017, 37(6): 1650-1656.
[14]	ZHOU Min, ZHOU Anmin, LIU Liang, JIA Peng, TAN Cuijiang. Mining denial of service vulnerability in Android applications automatically [J]. Journal of Computer Applications, 2017, 37(11): 3288-3293.
[15]	LU Xiaoyong, CHEN Musheng, WU Jhenglong, CHANG Peichan. Web spam detection based on immune clonal feature selection and under-sampling ensemble [J]. Journal of Computer Applications, 2016, 36(7): 1899-1903.