VMD: A Visualizable Malware Detection Scheme Based on Multi-dimensional Dynamic Behavior Information

Enormous traditional malware detection methods have been proposed and they are efficient in detecting known malware, however, these methods usually either are ineffective or have high false positive rate in detecting unknown malware. To improve the performance in unknown malware detection, many novel methods are presented by introducing and employing software behavior visualization, Artificial Intelligence, and other popular technologies. Unfortunately, they are still facing the inadequate data utilization and benchmark dataset lack problems. Therefore, in this paper, we propose an effective malware detection method by utilizing multi-dimensional software dynamic behavior information. To construct the concrete scheme, we combine a mapping mechanism from key parameters of software operation to grayscale images with a malware prediction model. In addition, to our knowledge, we constructed the first publicly accessible software dynamic behavior dataset containing over 800 malicious and 600 non-malicious software behavior images. Finally, the experiment results show that our method can effectively detect unknow malware and outperforms the existing comparative baseline schemes in terms of accuracy, precision, and recall.