Image-Based Malware Detection Using α-Cuts and Binary Visualisation
Source abstract
Abstract
Image conversion of malicious binaries, or binary visualisation, is a relevant approach in the security community. Recently, it has exceeded the role of a single-file malware analysis tool and has become a part of Intrusion Detection Systems (IDSs) thanks to the adoption of Convolutional Neural Networks (CNNs). However, there has been little effort toward image segmentation for the converted images. In this study, we propose a novel method that serves a dual purpose: (a) it enhances colour and pattern segmentation, and (b) it achieves a sparse representation of the images. According to this, we considered the R, G, and B colour values of each pixel as respective fuzzy sets. We then performed α-cuts as a defuzzification method across all pixels of the image, which converted them to sparse matrices of 0s and 1s. Our method was tested on a variety of dataset sizes and evaluated according to the detection rates of hyperparameterised ResNet50 models. Our findings demonstrated that for larger datasets, sparse representations of intelligently coloured binary images can exceed the model performance of unprocessed ones, with 93.60% accuracy, 94.48% precision, 92.60% recall, and 93.53% f-score. This is the first time that α-cuts were used in image processing and according to our results, we believe that they provide an important contribution to image processing for challenging datasets. Overall, it shows that it can become an integrated component of image-based IDS operations and other demanding real-time practices.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Digital Media Forensic Detection · Cell Image Analysis Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Lab of Mathematics and Informatics (ISCE), Faculty of Mathematics, Programming and General Courses, Department of Civil Engineering, School of Engineering, Democritus University of Thrace, Kimmeria, 67100 Xanthi, Greece
School of Computing, University of Portsmouth, Portsmouth PO1 2UP, UK
Centre for Cybercrime and Economic Crime, University of Portsmouth, Portsmouth PO1 2UP, UK
Funding
European Union’s Horizon 2020 research · innovation programme
References (100+)
Show source-provided references
1. Sahin, M., and Bahtiyar, S. (2020, January 4–7). A Survey on Malware Detection with Deep Learning. Proceedings of the 13th International Conference on Security of Information and Networks, Merkez, Turkey.10.1145/3433174.3433609 ↗
2. An enhancement for image-based malware classification using machine learning with low dimension normalized input images
3. Image-Based malware classification using ensemble of CNN architectures (IMCEC)10.1016/j.cose.2020.101748 ↗
4. Stupka, V., Horák, M., and Husák, M. (September, January 29). Protection of personal data in security alert sharing platforms. Proceedings of the 12th International Conference on Availability, Reliability and Security, Reggio Calabria, Italy.
5. Guidelines for stego/malware detection tools: Achieving GDPR compliance10.1109/MTS.2020.3031848 ↗
6. Yoo, I. (2004, January 29). Visualizing windows executable viruses using self-organizing maps. Proceedings of the 2004 ACM Workshop on Visualization and Data mining For Computer Security, Washington, DC, USA.10.1145/1029208.1029222 ↗
7. Conti, G., Dean, E., Sinda, M., and Sangster, B. Visual reverse engineering of binary and data files. Proceedings of the International Workshop on Visualization for Computer Security.
8. Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B.S. (2011, January 20). Malware images: Visualization and automatic classification. Proceedings of the 8th International Symposium on Visualization for Cyber Security, Pittsburgh, PA, USA.10.1145/2016904.2016908 ↗
9. Nataraj, L., Yegneswaran, V., Porras, P., and Zhang, J. (2011, January 21). A comparative assessment of malware classification using binary texture analysis and dynamic analysis. Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence, Chicago, IL, USA.10.1145/2046684.2046689 ↗
10. Spam: Signal processing to analyze malware [applications corner]10.1109/MSP.2015.2507185 ↗
11. Malware identification using visualization images and deep learning10.1016/j.cose.2018.04.005 ↗
12. Deep learning at the shallow end: Malware classification for non-domain experts10.1016/j.diin.2018.04.024 ↗
13. Baptista, I., Shiaeles, S., and Kolokotronis, N. (2019, January 20–24). A novel malware detection system based on machine learning and binary visualization. Proceedings of the 2019 IEEE International Conference on Communications Workshops (ICC Workshops), Shanghai, China.10.1109/ICCW.2019.8757060 ↗
14. O’Shaughnessy, S. (2019, January 23). Image-based malware classification: A space filling curve approach. Proceedings of the 2019 IEEE Symposium on Visualization for Cyber Security (VizSec), Vancouver, BC, Canada.10.1109/VizSec48167.2019.9161583 ↗
15. Image-based malware classification hybrid framework based on space-filling curves10.1016/j.cose.2022.102660 ↗
16. Shire, R., Shiaeles, S., Bendiab, K., Ghita, B., and Kolokotronis, N. (2019). Internet of Things, Smart Spaces, and Next Generation Networks and Systems, Springer.
17. Saridou, B., Rose, J.R., Shiaeles, S., and Papadopoulos, B. (2022). SAGMAD—A Signature Agnostic Malware Detection System Based on Binary Visualisation and Fuzzy Sets. Electronics, 11.10.3390/electronics11071044 ↗
18. Cortesi, A. (2023, February 03). Available online: binvis.io.
19. Color image segmentation based on different color space models using automatic GrabCut10.1155/2014/126025 ↗
20. Jungmann, A., Jatzkowski, J., and Kleinjohann, B. (2014, January 5–8). Evaluation of color spaces for robust image segmentation. Proceedings of the 2014 International Conference on Computer Vision Theory and Applications (VISAPP), Lisbon, Portugal.
21. Balaji, T., and Sumathi, D.M. (2014). Effective features of remote sensing image classification using interactive adaptive thresholding method. arXiv.
22. Srinivas, B., and Prasad, J.R. (2023, January 18). Enhanced Segmentation Algorithm for Hyper-spectral Imaging (HSI). Available online: https://www.jcreview.com/admin/Uploads/Files/61a8692a1af917.81078695.pdf.
23. An efficient pattern-based approach for insider threat classification using the image-based feature representation
24. Sai Adhinesh Reddy, T., Varma Vadlamudi, V.Y., Acharya, S., Rawat, U., and Bhatnagar, R. (2022, January 20–22). Windows Malware Detection Using CNN and AlexNet Learning Models. Proceedings of the 8th International Conference on Advanced Intelligent Systems and Informatics, Cairo, Egypt.10.1007/978-3-031-20601-6_25 ↗
25. A novel deep learning-based approach for malware detection10.1016/j.engappai.2023.106030 ↗
26. Marais, B., Quertier, T., and Chesneau, C. (2022). Distributed Computing and Artificial Intelligence, Volume 1: 18th International Conference 18, Springer International Publishing.
27. Ma, Z., Zhang, Z., Liu, C., Hu, T., Li, H., and Ren, B. (2022, January 3–5). Visualizable Malware Detection based on Multi-dimension Dynamic Behaviors. Proceedings of the 2022 International Conference on Networking and Network Applications (NaNA), Urumqi, China.10.1109/NaNA56854.2022.00049 ↗
28. An Adaptable Ensemble Architecture for Malware Detection10.1007/978-981-16-3071-2_53 ↗
29. Malani, H., Bhat, A., Palriwala, S., Aditya, J., and Chaturvedi, A. (2022, January 26). A Unique Approach to Malware Detection Using Deep Convolutional Neural Networks. Proceedings of the 2022 4th International Conference on Electrical, Control and Instrumentation Engineering (ICECIE), KualaLumpur, Malaysia.10.1109/ICECIE55199.2022.10000344 ↗
30. Lin, C.J., Huang, M.S., and Lee, C.L. (2022). Malware Classification Using Convolutional Fuzzy Neural Networks Based on Feature Fusion and the Taguchi Method. Appl. Sci., 12.10.3390/app122412937 ↗
31. Malware classification using a Taguchi-based deep learning network
32. Wang, S., Wang, J., Song, Y., Li, S., and Huang, W. (2022). Malware Variants Detection Model Based on MFF–HDBA. Appl. Sci., 12.10.3390/app12199593 ↗
33. Chong, X., Gao, Y., Zhang, R., Liu, J., Huang, X., and Zhao, J. (2022). Classification of Malware Families Based on Efficient-Net and 1D-CNN Fusion. Electronics, 11.10.3390/electronics11193064 ↗
34. S-DCNN: Stacked deep convolutional neural networks for malware classification10.1007/s11042-022-12615-7 ↗
35. Park, K.W., Bu, S.J., and Cho, S.B. (2022, January 5–7). Evolutionary Triplet Network of Learning Disentangled Malware Space for Malware Classification. Proceedings of the Hybrid Artificial Intelligent Systems: 17th International Conference, HAIS 2022, Salamanca, Spain.10.1007/978-3-031-15471-3_27 ↗
36. Shukla, S., Dhavlle, A., PD, S.M., Homayoun, H., and Rafatirad, S. (2022, January 23–26). Iron-Dome: Securing IoT Networked Systems at Runtime by Network and Device Characteristics to Confine Malware Epidemics. Proceedings of the 2022 IEEE 40th International Conference on Computer Design (ICCD), Olympic Valley, CA, USA.10.1109/ICCD56317.2022.00046 ↗
37. Kwan, L.M. (2022, January 1–4). Markov Image with Transfer Learning for Malware Detection and Classification. Proceedings of the TENCON 2022—2022 IEEE Region 10 Conference (TENCON), Hong Kong, China.10.1109/TENCON55691.2022.9977916 ↗
38. Kiger, J., Ho, S.S., and Heydari, V. (2022, January 7–8). Malware Binary Image Classification Using Convolutional Neural Networks. Proceedings of the International Conference on Cyber Warfare and Security, Islamabad, Pakistan.10.34190/iccws.17.1.59 ↗
39. Dharmalaksana, P.S., Mantoro, T., Khakim, L., and Nurseno, M. (2022, January 28–29). Improved Malware Detection Results using Visualization-Based Detection Techniques ant Convolutional Neural Network. Proceedings of the 2022 IEEE 8th International Conference on Computing, Engineering and Design (ICCED), Sukabumi, Indonesia.10.1109/ICCED56140.2022.10010439 ↗
40. An efficient convolutional neural network with transfer learning for malware classification10.1155/2022/4841741 ↗
41. Cher, G., and Liu, S. (2022, January 26–30). Reducing Malware labeling Efforts Through Efficient Prototype Selection. Proceedings of the 2022 26th International Conference on Engineering of Complex Computer Systems (ICECCS), Hiroshima, Japan.10.1109/ICECCS54210.2022.00011 ↗
42. Omar, M. New Approach to Malware Detection Using Optimized Convolutional Neural Network. Proceedings of the Machine Learning for Cybersecurity: Innovative Deep Learning Solutions.
43. A Multilayer Deep Learning Approach for Malware Classification in 5G-Enabled IIoT10.1109/TII.2022.3205366 ↗
44. Onoja, M., Aimufua, G., Jegede, A., Oyedele, A., Mazadu, J., and Olibodum, K. (2023, January 27). Exploring the Effectiveness and Efficiency of LightGBM Algorithm for Windows Malware Detection. Available online: https://www.researchgate.net/profile/Abayomi-Jegede/publication/366167472_2022_5th_Information_Technology_for_Education_and_Development_ITED/links/63945b6311e9f00cda32f6fb/2022-5th-Information-Technology-for-Education-and-Development-ITED.pdf.10.1109/ITED56637.2022.10051488 ↗
45. Classification of malware using visualization techniques10.1007/978-981-16-3071-2_60 ↗
46. Sern, L.J., Keng, T.K., and Fu, C.Z. (2022, January 24–26). BinImg2Vec: Augmenting Malware Binary Image Classification with Data2Vec. Proceedings of the 2022 1st International Conference on AI in Cybersecurity (ICAIC), Victoria, TX, USA.10.1109/ICAIC53980.2022.9897062 ↗
47. Kavitha, P.M., and Muruganantham, B. (2022). Mal_CNN: An Enhancement for Malicious Image Classification Based on Neural Network. Cybern. Syst., 1–14.10.1080/01969722.2022.2159001 ↗
48. Belguendouz, H., Guerid, H., and Kaddour, M. (2022, January 12–14). Static Classification of IoT Malware using Grayscale Image Representation and Lightweight Convolutional Neural Networks. Proceedings of the 2022 5th International Conference on Advanced Communication Technologies and Networking (CommNet), Marrakech, Morocco.10.1109/CommNet56067.2022.9993956 ↗
49. Agarwal, R., Patel, S., Katiyar, S., and Nailwal, S. (2022). Advanced Computing and Intelligent Technologies: Proceedings of ICACIT, Springer.
50. Fathurrahman, A., Bejo, A., and Ardiyanto, I. (2022, January 29–30). Lightweight Convolution Neural Network for Image-Based Malware Classification on Embedded Systems. Proceedings of the 2021 International Seminar on Machine Learning, Optimization, and Data Science (ISMODE), Jakarta, Indonesia.10.1109/ISMODE53584.2022.9743111 ↗
51. Ben Abdel Ouahab, I., Elaachak, L., and Bouhorma, M. (2022). Networking, Intelligent Systems and Security: Proceedings of NISS, Springer.
52. Qiu, L., Wang, S., Wang, J., Wang, Y., and Huang, W. (2022, January 20–22). Malware Classification based on a Light-weight Architecture of CNN: MalShuffleNet. Proceedings of the 2022 3rd International Conference on Computer Vision, Image and Deep Learning & International Conference on Computer Engineering and Applications (CVIDL & ICCEA), Changchun, China.10.1109/CVIDLICCEA56201.2022.9824719 ↗
53. Nguyen, H., Di Troia, F., Ishigaki, G., and Stamp, M. (2023). Generative adversarial networks and image-based malware classification. J. Comput. Virol. Hacking Tech., 1–17.10.1007/s11416-023-00465-2 ↗
54. Nagaraju, R., and Stamp, M. (2022). Artificial Intelligence for Cybersecurity, Springer.
55. A novel malware classification and augmentation model based on convolutional neural network10.1016/j.cose.2021.102515 ↗
56. Kuo, W.C., Chen, Y.T., Huang, Y.C., and Wang, C.C. (2021, January 18–20). Malware Detection Based on Image Conversion. Proceedings of the 2021 International Conference on Security and Information Technologies with AI, Internet Computing and Big-data Applications, Taichung, Taiwan.10.1007/978-3-031-05491-4_19 ↗
57. Tran, K., Di Troia, F., and Stamp, M. (2022, January 17–19). Robustness of Image-Based Malware Analysis. Proceedings of the Silicon Valley Cybersecurity Conference: Third Conference, SVCC 2022, Virtual Event. Revised Selected Papers.10.1007/978-3-031-24049-2_1 ↗
58. Agrafiotis, G., Makri, E., Flionis, I., Lalas, A., Votis, K., and Tzovaras, D. (2022, January 23–26). Image-based Neural Network Models for Malware Traffic Classification using PCAP to Picture Conversion. Proceedings of the 17th International Conference on Availability, Reliability and Security, Vienna, Austria.10.1145/3538969.3544473 ↗
59. Kim, H.M., and Lee, K.H. (2022). IIoT Malware Detection Using Edge Computing and Deep Learning for Cybersecurity in Smart Factories. Appl. Sci., 12.10.3390/app12157679 ↗
60. IDERES: Intrusion detection and response system using machine learning and attack graphs10.1016/j.sysarc.2022.102722 ↗
61. Toldinas, J., Venčkauskas, A., Liutkevičius, A., and Morkevičius, N. (2022). Framing Network Flow for Anomaly Detection Using Image Recognition and Federated Learning. Electronics, 11.10.3390/electronics11193138 ↗
62. Parkour, M. (2022, October 06). 16,800 Clean and 11,960 Malicious Files for Signature Testing and Research. Available online: https://contagiodump.blogspot.com/2013/03/16800-clean-and-11960-malicious-files.html.
63. Palus, H. (1998). The Colour Image Processing Handbook, Springer.
64. Chavolla, E., Zaldivar, D., Cuevas, E., and Perez, M.A. (2018). Advances in Soft Computing and Machine Learning in Image Processing, Springer.
65. XVIII.—Experiments on Colour, as perceived by the Eye, with Remarks on Colour-Blindness10.1017/S0080456800032117 ↗
66. On the theory of compound colours, and the relations of the colours of the spectrum
67. Klir, G., and Yuan, B. (1995). Fuzzy Sets and Fuzzy Logic, Prentice Hall.10.1109/45.468220 ↗
68. Wattenberg, M. (2005, January 23–25). A note on space-filling visualizations and space-filling curves. Proceedings of the IEEE Symposium on Information Visualization, 2005. INFOVIS 2005, Minneapolis, MN, USA.
69. Mandelbrot, B. (1977). Fractals, Freeman.
70. A fast acoustic emission beamforming localization method based on Hilbert curve10.1016/j.ymssp.2019.106291 ↗
71. Keller, A., Wächter, C., and Binder, N. (2022). Advances in Modeling and Simulation, Springer.
72. Wang, X., Sun, Y., Sun, Q., Lin, W., Wang, J.Z., and Li, W. (2022). HCIndex: A Hilbert-Curve-based clustering index for efficient multi-dimensional queries for cloud storage systems. Clust. Comput., 1–15.10.1007/s10586-022-03723-y ↗
73. Ueber die reellen Züge algebraischer Curven10.1007/BF01212696 ↗
74. Towards optimal locality in mesh-indexings10.1016/S0166-218X(00)00326-7 ↗
75. Ross, T.J. (2009). Fuzzy Logic with Engineering Applications, John Wiley & Sons.10.1002/9781119994374 ↗
76. A self-organizing neural network model for a mechanism of pattern recognition unaffected by shift in position10.1007/BF00344251 ↗
77. Fukushima, K., and Miyake, S. (1982). Competition and Cooperation in Neural Nets, Springer.
78. Neocognitron: A new algorithm for pattern recognition tolerant of deformations and shifts in position10.1016/0031-3203(82)90024-3 ↗
79. Neocognitron: A neural network model for a mechanism of visual pattern recognition10.1109/TSMC.1983.6313076 ↗
80. A neural network model for selective attention in visual pattern recognition10.1007/BF00363973 ↗
81. Neocognitron: A hierarchical neural network capable of visual pattern recognition10.1016/0893-6080(88)90014-7 ↗
82. Analysis of the process of visual pattern recognition by the neocognitron10.1016/0893-6080(89)90041-5 ↗
83. Backpropagation applied to handwritten zip code recognition10.1162/neco.1989.1.4.541 ↗
84. Handwritten digit recognition with a back-propagation network
85. Signature verification using a “siamese” time delay neural network
86. Convolutional networks for images, speech, and time series
87. Gradient-based learning applied to document recognition10.1109/5.726791 ↗
88. Deep convolutional neural networks for image classification: A comprehensive review10.1162/neco_a_00990 ↗
89. Review of deep learning: Concepts, CNN architectures, challenges, applications, future directions10.1186/s40537-021-00444-8 ↗
90. He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27–30). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Las Vegas, NV, USA.10.1109/CVPR.2016.90 ↗
91. Bendiab, G., Shiaeles, S., Alruban, A., and Kolokotronis, N. (July, January 29). IoT malware network traffic classification using visual representation and deep learning. Proceedings of the 2020 6th IEEE Conference on Network Softwarization (NetSoft), Ghent, Belgium.10.1109/NetSoft48620.2020.9165381 ↗
92. Van Rossum, G., and Drake, F.L. (1995). Python Tutorial, Centrum voor Wiskunde en Informatica.
93. Warner, J., Sexauer, J., Unnikrishnan, A., Castelão, G., Pontes, F.A., Uelwer, T., and Batista, F. (2022, June 07). JDWarner/Scikit-Fuzzy: Scikit-Fuzzy, Version 0.4.2; 2019. Available online: https://zenodo.org/record/3541386.
94. (2022, August 11). Google Colaboratory. Available online: https://colab.research.google.com/.
95. Loizides, F., and Schmidt, B. Jupyter Notebooks—A publishing format for reproducible computational workflows. Proceedings of the Positioning and Power in Academic Publishing: Players, Agents and Agendas.
96. Sparsity in deep learning: Pruning and growth for efficient inference and training in neural networks
97. Pichel, J.C., and Pateiro-López, B. (2018, January 10–13). A new approach for sparse matrix classification based on deep learning techniques. Proceedings of the 2018 IEEE International Conference on Cluster Computing (CLUSTER), Belfast, UK.10.1109/CLUSTER.2018.00017 ↗
98. Ankner, Z., Renda, A., Dziugaite, G.K., Frankle, J., and Jin, T. (2022). The Effect of Data Dimensionality on Neural Network Prunability. arXiv.
99. Goled, S. (2022, December 19). Future Is Sparse: Prof Nir Shavit, Neural Magic. Available online: https://analyticsindiamag.com/future-is-sparse-prof-nir-shavit-neural-magic/.
100. Hammad, B.T., Jamil, N., Ahmed, I.T., Zain, Z.M., and Basheer, S. (2022). Robust Malware Family Classification Using Effective Features and Classifiers. Appl. Sci., 12.10.3390/app12157877 ↗