하이브리드 데이터셋을 이용한 악성코드 패밀리 분류
Classification of Malware Families Using Hybrid Datasets
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 변종 악성코드가 증가하면서 사이버 해킹 침해사고 규모가 확대되고 있다. 그리고 지능형 사이버 해킹 공격에 대응하기 위해 악성코드 패밀리를 효과적으로 분류하기 위한 기계학습 기반 연구가 활발히 진행되고 있다. 그러나 기존의 분류 모델은 데이터셋이 난독화되거나, 희소한 경우에 성능이 저하되는 문제가 있었다. 본 논문에서는 ASM 파일과 BYTES 파일에서 추출한 특징을 결합한 하이브리드 데이터셋을 제안하고, FNN을 사용하여 분류 성능을 평가한다. 실험 결과에 따르면 제안하는 방법은 단일 데이터셋에 비해 약 4% 향상된 성능을 보였으며, 특히 희소한 패밀리에 대해서는 약 30%의 성능 향상을 보였다.
Abstract
Recently, as variant malware has increased, the scale of cyber hacking incidents is expanding. To respond to intelligent cyberhacking attack, machine learning-based research is actively underway to effectively classify malware families. However, existing classification models have problems where performance deteriorates when the dataset is obfuscated or sparse. In this paper, we propose a hybrid dataset that combines features extracted from ASM files and BYTES files, and evaluate classification performance using FNN. As a result of the experiment, the proposed method showed performance improvement of about 4% compared to a single dataset, and in particular, performance improvement of about 30% for rare families.
참고문헌 (24)
- Faitouri A. Aboaoja, "Malware Detection Is-sues, Challenges, and Future Directions : A Survey", Applied Sciences, 12(17), pp.8482~ (2022)
- Gaurav, Akshat, "A comprehensive survey on machine learning approaches for malware detection in IoT-based enterprise information system", Enterprise Information Systems, 17(3), pp.2023764~ (2023)
- Baoguo Yuan, "IoT Malware Classification Based on Lightweight Convolutional Neural Networks", IEEE Internet of Things Journal, 9(5), pp.3770~3783 (2022)
- "Malware statistics and facts for 2023"[URL]
- "Cybercrime To Cost The World $10.5 Trillion Annually By 2025"[URL]
- Ansam Khraisat, "Survey of intrusion detection systems : techniques, datasets and challenges", Cybersecurity (2019)
- Fahad Alswaina, "Android Malware Family Classification and Analysis : Current Status and Future Directions", Electronics, 9(6), pp.942~ (2020)
- 한채림, "머신러닝 기반 악성 URL 탐지 기법", 정보보호학회논문지, 32(3), pp.555~564 (2022), 한국정보보호학회[DOI]
- 임은지, "머신러닝을 활용한 행위 및 스크립트 유사도 기반 크립토재킹 탐지 프레임워크", 정보보호학회논문지, 31(6), pp.1105~1114 (2021), 한국정보보호학회[DOI]
- Jiang, J, "A pyramid stripe pooling-based convolutional neural network for malware detection and classification", J Ambient Intell Human Comput, 14, pp.2785~2796 (2023)
- Y. C. Qiao, "Research on malicious code classification based on assembly instruction word vector and convolutional neural network", Infor-mation network security, 04, pp.20~28 (2019)
- Ahmed Bensaoud, "Classifying Malware Images with Convolutional Neural Network Models" (2020)
- Hanqi Zhang, "Classification of ransomware families with machine learning based on N-gram of opcodes", Fusture Generation Computer Systems, 90, pp.211~221 (2019)
- Rajasekhar Chagantia, "Image-based Malware Representation Approach with EfficientNet ConvolutionalNeural Networks for Effective Malware Classification", Journal of Information Security and Applications, 69, pp.103306~ (2022)
- Ketan Gupta, "A Neural Network Approach For Malware Classification", 2022 International Conference on Computing, Communication, and Intelligent Systems(ICCCIS), pp.681~684 (2022)
- Zhu X, "Malware homology determination using visualized images and feature fusion", PeerJ Computer Sci, 7 (2021)
- Parvin, H., "A New N-gram Feature Extraction-Selection Method for Malicious Code", Lecture Notes in Computer Science, pp.98~107 (2011)
- Aninditya, Annisa, "Text mining ap-proach using TF-IDF and naive Bayes for classification of exam questions based on cognitive level of bloom's taxonomy", 2019 IEEE International Conference on Internet of Things and Intelligence System(IoTaIS), pp.112~117 (2019)
- Akuma, Stephen, "Comparing Bag of Words and TF-IDF with different models for hate speech detection from live tweets", International Journal of Information Technology, 14, pp.3629~3635 (2022)
- Liu, Yipeng, "Integrating Information Entropy and Latent Dirichlet Allocation Models for Analysis of Safety Accidents in the Construction Industry", Buildings, 13(7), pp.1831~ (2023)
- Y. Li, "Research on sentiment analysis of microblogging based on LSA and TF-IDF", 2017 3rd IEEE International Conference on Computer and Communications(ICCC), pp.2584~2588 (2017)
- Adarsh Kumar Singh, "Android Malware Detection using LSI-based Reduced Opcode Feature Vector", Procedia Computer Science, 173, pp.291~298 (2020)
- Ronen, R., "Microsoft malware classification challenge" (2018)
- Aman, N., "A Hybrid Approach for Malware Family Classification", Communications in Computer and Information Science, 719 (2017), Springer