Malicious Software-based Image Classification Via Deep Convolutional Neural Networks

Malicious software (Malware) classification is an important factor in the security of the computer systems. On the other hand, currently utilized signature-based methods cannot provide accurate detection of zero-day attacks and the ability to group malware variants into families with similar characteristics makes possible to create mitigation strategies that work for a whole class of programs. This paper presents two malware family classification approaches, the first system based on transfer learning, using Convolutional Neural Networks pertained on ImageNet database by adapting the last layers to malware family classification, while the second system uses the DCNN as a bottleneck feature extractor and use these features to train a multiclass classifier using traditional machine learning algorithms, namely, support vector machines (SVM), k-Nearest Neighbor (KNN) and Naïve Bayes (NB), the main benefit of this method that it does not require any disassembly or execution of the actual malware code. The experimental results showed that the first proposed approach could effectively be used to classify malware families with an accuracy of 92.0% using AlexNet and 88.8% using GoogleNet, while SVM classifier achieving an accuracy of 88.8% with AlexNet and 86.4% with GoogleNet gave best results using the second approach. Achieved automatic malware classification can be very valuable to anti-malware industry and security researches