Li Sicong, Wang Jian, Wang Shuo, Song Yafei
College of Air and Missile Defense, Air Force Engineering University, Xi'an, 710051, PR China.
Unit of 95285, Chinese People's Liberation Army (PLA), GuiLin, 541000, PR China.
Heliyon. 2024 Aug 8;10(16):e35965. doi: 10.1016/j.heliyon.2024.e35965. eCollection 2024 Aug 30.
With the development of automated malware toolkits, cybersecurity faces evolving threats. Although visualization-based malware analysis has proven to be an effective method, existing approaches struggle with challenging malware samples due to alterations in the texture features of binary images during the visualization preprocessing stage, resulting in poor performance. Furthermore, to enhance classification accuracy, existing methods sacrifice prediction time by designing deeper neural network architectures. This paper proposes PAFE, a lightweight and visualization-based rapid malware classification method. It addresses the issue of texture feature variations in preprocessing through pixel-filling techniques and applies data augmentation to overcome the challenges of class imbalance in small sample datasets. PAFE combines multi-scale feature fusion and a channel attention mechanism, enhancing feature expression through modular design. Extensive experimental results demonstrate that PAFE outperforms the current state-of-the-art methods in both efficiency and effectiveness for malware variant classification, achieving an accuracy rate of 99.25 % with a prediction time of 10.04 ms.
随着自动化恶意软件工具包的发展,网络安全面临着不断演变的威胁。尽管基于可视化的恶意软件分析已被证明是一种有效的方法,但由于在可视化预处理阶段二进制图像的纹理特征发生变化,现有方法在处理具有挑战性的恶意软件样本时遇到困难,导致性能不佳。此外,为了提高分类准确率,现有方法通过设计更深的神经网络架构来牺牲预测时间。本文提出了PAFE,一种轻量级的基于可视化的快速恶意软件分类方法。它通过像素填充技术解决了预处理中纹理特征变化的问题,并应用数据增强来克服小样本数据集中类别不平衡的挑战。PAFE结合了多尺度特征融合和通道注意力机制,通过模块化设计增强了特征表达。大量实验结果表明,PAFE在恶意软件变体分类的效率和有效性方面均优于当前的最先进方法,在预测时间为10.04毫秒的情况下,准确率达到99.25%。