Image-based Malware Family Detection: An Assessment between Feature Extraction and Classification Techniques

Giacomo Iadarola, Fabio Martinelli, Francesco Mercaldo, Antonella Santone

2020

Abstract

The increasing number of malware in mobile environment follows the continuous growth of the app stores, which required constant research in new malware detection approaches, considering also the weaknesses of signature-based anti-malware software. Fortunately, most of the malware are composed of well-known pieces of code, thus can be grouped into families sharing the same malicious behaviour. One interesting approach, which makes use of Image Classification techniques, proposes to convert the malware binaries to images, extract feature vectors and classifying them with supervised machine learning models. Realizing that researchers usually evaluate their solutions on private datasets, it is difficult to establish whether a model can be generalized on another dataset, making it difficult to compare the performance of the various models. This paper presents a comparison between different combination of feature vector extraction methods and machine learning models. The methodology aimed to evaluate feature extractors and supervised machine learning algorithms, and it was tested on more than 20 thousand images of malware, grouped into 10 different malware families. The best classifier, a combination of GIST descriptors and Random Forest classifiers, achieved an accuracy of 0.97 on average.

Paper Citation

in Harvard Style

Iadarola G., Martinelli F., Mercaldo F. and Santone A. (2020). Image-based Malware Family Detection: An Assessment between Feature Extraction and Classification Techniques.In Proceedings of the 5th International Conference on Internet of Things, Big Data and Security - Volume 1: AI4EIoTs , ISBN 978-989-758-426-8, pages 499-506. DOI: 10.5220/0009817804990506

in Bibtex Style

@conference{ai4eiots 20,
author={Giacomo Iadarola and Fabio Martinelli and Francesco Mercaldo and Antonella Santone},
title={Image-based Malware Family Detection: An Assessment between Feature Extraction and Classification Techniques},
booktitle={Proceedings of the 5th International Conference on Internet of Things, Big Data and Security - Volume 1: AI4EIoTs ,},
year={2020},
pages={499-506},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0009817804990506},
isbn={978-989-758-426-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 5th International Conference on Internet of Things, Big Data and Security - Volume 1: AI4EIoTs ,
TI - Image-based Malware Family Detection: An Assessment between Feature Extraction and Classification Techniques
SN - 978-989-758-426-8
AU - Iadarola G.
AU - Martinelli F.
AU - Mercaldo F.
AU - Santone A.
PY - 2020
SP - 499
EP - 506
DO - 10.5220/0009817804990506