关键词: 网络安全, 恶意代码分类, RGB图像, 汇编信息, 语义关系, 坐标注意力模块, 空洞空间金字塔

Abstract:

The increasing variants malware bring a great threat to network security, leading to weak generalization and insufficient accuracy of existing base on the convolutional neural networks(CNN) malware classification methods. To solve these problems, an approach, namely, a classification method based on improved the CNN for malware RGB(Red Green Blue) visualization that can resist variants and obfuscation malware. Firstly, our method proposed a feature representation method based on RGB image, which pays more attention to the semantic relationship between binary, assembly information and API information of malware. The generated image, with richer vein information, that can uncover deeper dependencies between the original and variants of the malware. Secondly, to address the problems of malware encryption and obfuscation, this paper uses the coordinate attention attention module(CAAM) to obtain a larger range of the spatial information to strengthen malware features. Finally, the Atrous spatial pyramid pooling(ASPP) is combined to improve the CNN model to address the information loss and redundancy due to image size normalization. The experimental results show that the above methods stands out among the recent advanced methods with an accuracy of 99.48% and 97.78% for dataset Kaggle and dataset DataCon. Compared with the other methods, our method had the accuracy increased by 0.22% for dataset Kaggle, and had the accuracy increased by 0.80% for dataset DataCon. Our method can effectively classify malware and variants of malware families, which has excellent generalization ability and anti-obfuscation ability.

Key words: network security, malware classification, RGB image, compile information, semantic relationship, coordinate attention attention module, atrous spatial pyramid pooling