论文标题
将恶意软件图像与卷积神经网络模型分类
Classifying Malware Images with Convolutional Neural Network Models
论文作者
论文摘要
由于数字和复杂性的恶意软件（恶意软件）威胁的增加，研究人员开发了对恶意软件进行自动检测和分类的方法，而不是在耗时的努力中手动分析恶意软件文件的方法。同时，恶意软件作者开发了逃避防病毒公司使用的基于签名的检测技术的技术。最近，在恶意软件分类中使用了深度学习来解决此问题。在本文中，我们使用多个卷积神经网络（CNN）模型进行静态恶意软件分类。特别是，我们使用六个深度学习模型，其中三个是ImageNet大规模视觉识别挑战的过去赢家。其他三个模型是CNN-SVM，GRU-SVM和MLP-SVM，它通过支持向量机（SVM）增强神经模型。我们使用Malimg数据集执行实验，该数据集具有从便携式可执行恶意软件二进制文件转换的恶意软件图像。数据集分为25个恶意软件系列。比较表明，Inception V3模型的测试精度为99.24％，这比当前最新系统（称为M-CNN模型）实现的98.52％的精度要好。
Due to increasing threats from malicious software (malware) in both number and complexity, researchers have developed approaches to automatic detection and classification of malware, instead of analyzing methods for malware files manually in a time-consuming effort. At the same time, malware authors have developed techniques to evade signature-based detection techniques used by antivirus companies. Most recently, deep learning is being used in malware classification to solve this issue. In this paper, we use several convolutional neural network (CNN) models for static malware classification. In particular, we use six deep learning models, three of which are past winners of the ImageNet Large-Scale Visual Recognition Challenge. The other three models are CNN-SVM, GRU-SVM and MLP-SVM, which enhance neural models with support vector machines (SVM). We perform experiments using the Malimg dataset, which has malware images that were converted from Portable Executable malware binaries. The dataset is divided into 25 malware families. Comparisons show that the Inception V3 model achieves a test accuracy of 99.24%, which is better than the accuracy of 98.52% achieved by the current state-of-the-art system called the M-CNN model.
