Convolutional Neural Network 기반의 악성코드 이미지화를 통한 패밀리 분류
Visualized Malware Classification Based-on Convolutional Neural Network
0
조회
0
다운로드
15
인용
0
참고문헌
키워드
초록
본 논문에서는 악성코드를 실행시키지 않고 패밀리를 분류하는 방법으로 악성 코드 파일을 8-bit gray-scale 이미지로 시각화 하고 이미지 인식분야에서 널리 쓰이고 있는 convolutional neural network를 통해 악성코드를분류해내는 기법을 제안한다. 9개의 악성코드 패밀리로 분류해 내는 실험의 Top-1,2 예측 정확도는 각각 96.2%, 98.7%을 기록하였고, 27개의 패밀리를 분류하는 실험의 경우 Top-1 예측 정확도는 82.9%, Top-2는 89%로 악성코드 패밀리를 분류할 수 있다.
Abstract
In this paper, we propose a method based on a convolutional neural network which is one of the deep neural network. So, we convert a malware code to malware image and train the convolutional neural network. In experiment with classify 9-families, the proposed method records a 96.2%, 98.7% of top-1, 2 error rate. And our model can classify 27 families with 82.9%, 89% of top-1,2 error rate.
참고문헌 (20)
- "Malware Statistics"[URL]
- K. S. Han, "Malware classification using instruction frequencies", Proceedings of the 2011ACM Symposium on Research in Applied Computation, RACS '11, pp.298~300 (2011), ACM
- J. Kinable, "Malware classication based on call graph clustering", Journal in Computer Virology, 7(4), pp.233~245 (2011)
- M. Islam, "Classication of malware based on string and function feature selection", Cybercrime and Trustworthy Computing Workshop(CTC), pp.9~17 (2010)
- R. Tian, "Function length as a tool for malware classication", Malicious and Unwanted Software, 2008. MALWARE 2008. 3rd International Conference on, pp.69~76 (2008)
- M. Bailey, ""Automated classification and analysis of internet malware," in Recent Advances in Intrusion Detection", Lecture Notes in Computer Science, 4637, pp.178~197 (2007)
- M. Zolkipli, "An approach for malware behavior identification and classification", Computer Research and Development (ICCRD), 2011 3rd International Conference on, 1, pp.191~194 (2011)
- R. Islam, "Classification of malware based on integrated static and dynamic features", Journal of Network and Computer Applications, 36(2), pp.646~656 (2013)
- 서희석, "윈도우 악성코드 분류 시스템에 관한 연구", 한국시뮬레이션학회 논문지, 18(1), pp.63~70 (2009), 한국시뮬레이션학회
- R. Pascanu, "Malware classification with recurrent networks", Acoustics, Speech and Signal Processing (ICASSP), 2015 IEEE International Conference on, pp.1916~1920 (2015)
- W. Jung, "Poster:Deep learning for zero-day ash malware detection", ~ (2015)
- L. Nataraj, "A comparative assessment of malware classication using binary texture analysis and dynamic analysis", Proceedings of the 4th ACM Workshop on Security and Articial Intelligence, AISec '11, pp.21~30 (2011), ACM
- A. Krizhevsky, "Advances in neural information processing systems", pp.1097~1105 (2012)
- "Vx heaven virus collection 2010-05-18"[URL]
- "VirusTotal"[URL]
- M. Sokolova, "A systematic analysis of performance measures for classication tasks", Information Processing & Management, 45(4), pp.427~437 (2009)
- K. Rieck, "Detection of Intrusions and Malware, and Vulnerability Assessment", pp.108~125 (2008), Springer
- 한병진, "악성코드 DNA 생성을 통한 유사 악성코드 분류기법", 정보보호학회논문지, 23(4), pp.679~694 (2013), 한국정보보호학회[DOI]
- L. Nataraj, "Malware images:Visualization and automatic classication", Proceedings of the 8th International Symposium on Visualization for Cyber Security, VizSec '11, pp.4:1~4:7 (2011), ACM