抗混淆的恶意代码图像纹理特征描述方法

doi:10.11959/j.issn.1000-436x.2018227

通信学报 ›› 2018, Vol. 39 ›› Issue (11): 44-53.doi: 10.11959/j.issn.1000-436x.2018227

抗混淆的恶意代码图像纹理特征描述方法

刘亚姝^1,²,王志海¹(),严寒冰³,侯跃然⁴,来煜坤⁵

¹ 北京交通大学计算机与信息技术学院，北京 100044
² 北京建筑大学电气与信息工程学院，北京 100044
³ 国家计算机网络应急技术处理协调中心，北京 100029
⁴ 北京邮电大学网络技术研究院，北京 100876
⁵ 卡迪夫大学计算机科学与信息学院，英国卡迪夫，CF24 3AA

修回日期:2018-10-26 出版日期:2018-11-01 发布日期:2018-12-10
作者简介:刘亚姝（1977?），女，吉林大安人，北京交通大学博士生，主要研究方向为信息安全、数据挖掘。|王志海（1963–），男，河南安阳人，博士，北京交通大学教授、博士生导师，主要研究方向为数据挖掘、机器学习、计算智能。|严寒冰（1975–），男，江西进贤人，博士，国家计算机网络应急技术处理协调中心教授级高工、博士生导师，主要研究方向为信息安全。|侯跃然（1994–），男，内蒙古呼和浩特人，北京邮电大学硕士生，主要研究方向为信息安全、机器学习。|来煜坤（1978–），男，浙江萧山人，博士，英国卡迪夫大学副教授，主要研究方向为计算机视觉、图像处理。
基金资助:
国家自然科学基金资助项目(U1736218);国家自然科学基金资助项目(61672086);国家重点研发计划基金资助项目(2018YFB0803604)

Method of anti-confusion texture feature descriptor for malware images

Yashu LIU^1,²,Zhihai WANG¹(),Hanbing YAN³,Yueran HOU⁴,Yukun LAI⁵

¹ School of Computer and Information Technology,Beijing Jiaotong University,Beijing 100044,China
² School of Electrical and Information Engineering,Beijing University of Civil Engineering and Architecture，Beijing 100044,China
³ National Computer Network Emergency Response Technical Team/Coordination Center of China,Beijing 100029,China
⁴ Institute of Network Technology,Beijing University of Posts and Telecommunication,Beijing 100876,China
⁵ School of Computer Science and Informatics,Cardiff University,Cardiff CF24 3AA,UK

Revised:2018-10-26 Online:2018-11-01 Published:2018-12-10
Supported by:
The National Natural Science Foundation of China(U1736218);The National Natural Science Foundation of China(61672086);The National Key Research and Development Program of China(2018YFB0803604)

摘要/Abstract

摘要：

将图像处理技术与机器学习方法相结合是恶意代码可视化研究的一个新方法。在这种研究方法中，恶意代码灰度图像纹理特征的描述对恶意代码分类结果的准确性影响较大。为此，提出新的恶意代码图像纹理特征描述方法。通过将全局特征（GIST）与局部特征（LBP或dense SIFT）相融合，构造抗混淆、抗干扰的融合特征，解决了在恶意代码灰度图像相似度较高或差异性较大时全局特征分类准确性急剧降低的问题。实验表明，该方法与传统方法相比具有更好的稳定性和适用性，同时在较易混淆的数据集上，分类准确率也有了明显的提高。

关键词: 恶意代码可视化, 图像纹理, 特征描述符, 恶意代码分类

Abstract:

It is a new method that uses image processing and machine learning algorithms to classify malware samples in malware visualization field.The texture feature description method has great influence on the result.To solve this problem,a new method was presented that joints global feature of GIST with local features of LBP or dense SIFT in order to construct combinative descriptors of malware gray-scale images.Using those descriptors,the malware classification performance was greatly improved in contrast to traditional method,especially for those samples have higher similarity in the different families,or those have lower similarity in the same family.A lot of experiments show that new method is much more effective and general than traditional method.On the confusing dataset,the accuracy rate of classification has been greatly improved.

Key words: malware visualization, image texture, feature descriptors, malware classification

中图分类号:

TP393

刘亚姝,王志海,严寒冰,侯跃然,来煜坤. 抗混淆的恶意代码图像纹理特征描述方法[J]. 通信学报, 2018, 39(11): 44-53.

Yashu LIU,Zhihai WANG,Hanbing YAN,Yueran HOU,Yukun LAI. Method of anti-confusion texture feature descriptor for malware images[J]. Journal on Communications, 2018, 39(11): 44-53.

图/表 15

图1

表1

图2

表2

表3

图3

图4

表4

表5

表6

表7

表8

表9

图5

表10

参考文献 21

[1]	杜敬凯 . 二进制恶意代码的同源性分析[D]. 北京:北京航空航天大学, 2016.
	DU J K . Homology analysis of binary malicious code[D]. Beijing:Beihang University, 2016.
[2]	SATHYANARAYAN V S , KOHLI P , BRUHADESHWAR B . Signature generation and detection of malware families[C]// Proceedings of Australasian Conference on Information Security and Privacy. 2008: 336-349.
[3]	ABBAS M F B , SRIKANTHAN T . Low-complexity signature-based malware detection for IoT devices[C]// Proceedings of Applications and Techniques in Information Security. 2017: 181-189.
[4]	FIRDAUSI I , LIM C , ERWIN A ,et al. Analysis of machine learning techniques used in behavior-based malware detection[C]// IEEE International Conference on Advances in Computing. 2010: 201-203.
[5]	王蕊, 冯登国, 杨轶 ,等. 基于语义的恶意代码行为特征提取及检测方法[J]. 软件学报, 2012,23(2): 378-393.
	WANG R , FENG D G , YANG Y ,et al. Semantics-based malware be-havior signature extraction and detection method[J]. Journal of Soft-ware, 2012,23(2): 378-393.
[6]	任李, 潘晓中 . 基于对象语义的恶意代码检测方法[J]. 计算机应用研究, 2013,30(10): 3106-3113.
	REN L , PAN X Z . Object-semantics based malware detection meth-od[J]. Application Research of Computers, 2013,30(10): 3106-3113.
[7]	SANTOS I , BREZO F , NIEVES J ,et al. Idea:opcode-sequence based malware detection[C]// International Conference on Engineering Secure Software and Systems. 2010: 35-43.
[8]	O’KANE P , SEZERAND S , MCLANGHLIN K . Detecting obfuscated malware using reduced opcode set and optimized runtime trace[J]. Security Informatics, 2016,5(1): 2-13.
[9]	QIAO Y C , YUN X C , ZHANG Y Z ,et al. Fast reused function retrieval method based on simHash and inverted index[C]// The 15th IEEE International Conference on Trust,Security and Privacy in Computing and Communications. 2017: 937-944.
[10]	BONFANTE G , KACZMAREK M , MARION JY . Architecture of a morphological malware detector[J]. Computer Virology, 2009,5(3): 263-270.
[11]	CESARE S , XIANG Y . A fast flow graph based classification system for packed and polymorphic malware on the end host[C]// Proceedings of the 24th IEEE International Conference on Advanced Information Networking and Applications. 2010: 721-728.
[12]	KINABLE J , KOSTAKIS O . Malware classification based on call graph clustering[J]. Computer Virology, 2011,7(4): 233-245.
[13]	TRINIUS P , HOLS T , GOBEL J ,et al. Visual analysis of malware behavior using treemaps and thread graphs[C]// the 6th International Workshop on Visualization for Cyber Security. 2010: 33-38.
[14]	CONTI G , BRATUS S , SHUBING A ,et al. Automated mapping of large binary objects using primitive fragment type classification[J]. Digital Investigation:The International Journal of Digital Forensics and Incident Response, 2010,7: S3-S12.
[15]	NATARAJ L , KARTHIKEYAN S , JACOB G ,et al. Malware images:visualization and automatic classification[C]// The 8th International Symposium on Visualization for Cyber Security. 2011: 21-29.
[16]	HAN K S , LIM J H , KANG B J ,et al. Malware analysis using visualized images and entropy graphs[J]. International Journal of Information Security, 2015,14(1): 1-14.
[17]	YAN H B , ZHOU H , ZHANG H G . Automatic malware classification via PRICoLBP[J]. Chinese Journal of Electronics, 2018,27(4): 852-859.
[18]	OLIVA A , TORRALBA A . Modeling the shape of the scene:a holistic representation of the spatial envelope[J]. International Journal of Computer Vision, 2001,42(3): 145-175.
[19]	TORRALBA A , MURPHY A , FREEMAN K P ,et al. Context-based vision systems for place and object recognition[C]// International conference on Computer Vision. 2003:273.
[20]	OJALA T , PIETIKAINEN M , MAENPAA T . Multiresolution gray-scale and rotation invariant texture classification with local binary patterns[J]. IEEE Transactions on Pattern Analysis ＆ Machine Intelligence, 2000,24(7): 971-987.
[21]	LOWE D G , . Object recognition from local scale-invariant features[C]// International Conference on Computer Vision. 1999: 1150-1157.

文件大小	图像宽度
<10 KB	32
10~ 30 KB	64
30~ 60 KB	128
60~ 100 KB	256
100~ 200 KB	384
200~ 500 KB	512
500 ~ 1000 KB	768
>1 000	1 024

分类器	k	准确率
	1	0.976
	2	0.98
	3	0.978
	4	0.977
	5	0.976
KNN	6	0.978
	7	0.97
	8	0.964
	9	0.965
	10	0.96
RF	estimator=15	0.988

分类器	k	GIST	dense	LBP
	1	0.910	0.936	0.877
	2	0.905	0.926	0.864
	3	0.900	0.925	0.86
	4	0.900	0.909	0.863
	5	0.897	0.913	0.863
KNN	6	0.883	0.912	0.86
	7	0.884	0.914	0.848
	8	0.896	0.914	0.839
	9	0.884	0.912	0.843
	10	0.899	0.906	0.838
RF	estimator=15	0.901	0.922	0.901

家族名称	图像数目
Autorun.K	95
Benign	365
Fakerean	381
Luder.B	509
Obfuscator.AD	142
Skintrim.N	80
Virut.A	133
Virut.AC	269
Virut.AK	571

No.	准确率
1	0.914
2	0.886
3	0.910
4	0.867
5	0.906
6	0.882
7	0.906
8	0.894
9	0.906
10	0.89
平均准确率	0.896

抗混淆的恶意代码图像纹理特征描述方法

Method of anti-confusion texture feature descriptor for malware images

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 15

参考文献 21

相关文章 15

Metrics

推荐阅读 0

RF	Gist特征与LBP特征相融合					Gist	LBP
RF	Gist_10%LBP	Gist_30%LBP	Gist_50%LBP	Gist_70%LBP	Gist_100%LBP	Gist	LBP
estimator=10	0.954	0.958	0.959	0.957	0.958	0.893	0.899
estimator=15	0.953	0.958	0.961	0.960	0.961	0.901	0.901
estimator=20	0.955	0.960	0.962	0.961	0.964	0.899	0.903
estimator=25	0.957	0.963	0.965	0.962	0.964	0.900	0.904

RF	Gist特征与dense SIFT特征相融合					Gist	Dense
RF	10% dense SIFT	30% dense SIFT	50% dense SIFT	70% dense SIFT	100% dense SIFT	Gist	SIFT
estimator=10	0.957	0.960	0.960	0.960	0.960	0.893	0.924
estimator=15	0.961	0.962	0.963	0.964	0.964	0.901	0.922
estimator=20	0.963	0.964	0.963	0.964	0.963	0.899	0.931
estimator=25	0.965	0.965	0.965	0.966	0.966	0.900	0.923

特征表示方法	准确率
文献[15]	0.901 7
文献[16]	0.912
文献[17]	0.932 9
本文方法	0.949 8

[1]	李竟博, 马礼, 李阳, 傅颖勋, 马东超. 感传算协同工业互联网优化设计[J]. 通信学报, 2023, 44(6): 12-22.
[2]	赵仕祺, 黄小红, 钟志港. 基于信誉的域间路由选择机制的研究与实现[J]. 通信学报, 2023, 44(6): 47-56.
[3]	陈真, 陈文辉, 刘啸威, 尤殿龙, 刘林林, 申利民. 功能互补关系增强的云API推荐方法[J]. 通信学报, 2023, 44(6): 125-137.
[4]	魏德宾, 潘成胜, 杨力, 颜佐任. 基于网络流量水平等级预测的自适应随机早期检测算法[J]. 通信学报, 2023, 44(6): 154-166.
[5]	李元诚, 秦永泰. 基于深度强化学习的软件定义安全中台QoS实时优化算法[J]. 通信学报, 2023, 44(5): 181-192.
[6]	夏莹杰, 朱思雨, 刘雪娇. 区块链架构下具有条件隐私的车辆编队跨信任域高效群组认证研究[J]. 通信学报, 2023, 44(4): 111-123.
[7]	谢人超, 文雯, 唐琴琴, 刘云龙, 谢高畅, 黄韬. 轨道交通移动边缘计算网络安全综述[J]. 通信学报, 2023, 44(4): 201-215.
[8]	罗智勇, 张玉, 王青, 宋伟伟. 基于贝叶斯攻击图的SDN入侵意图识别算法的研究[J]. 通信学报, 2023, 44(4): 216-225.
[9]	王一丰, 郭渊博, 陈庆礼, 方晨, 林韧昊, 周永良, 马佳利. 基于对比增量学习的细粒度恶意流量分类方法[J]. 通信学报, 2023, 44(3): 1-11.
[10]	张进, 葛强, 徐伟海, 江逸茗, 马海龙, 于洪涛. 拟态路由器BGP代理的设计实现与形式化验证[J]. 通信学报, 2023, 44(3): 33-44.
[11]	经普杰, 王良民, 董学文, 张玉书, 王骞, Muhammad Sohail. 分层跨链结构：一种面向区块链系统监管的可行架构[J]. 通信学报, 2023, 44(3): 93-104.
[12]	舒坚, 史佳伟, 刘琳岚, Manar Al-Kali. 基于时空卷积的机会网络拓扑预测[J]. 通信学报, 2023, 44(3): 145-156.
[13]	王东滨, 吴东哲, 智慧, 郭昆, 张勖, 时金桥, 张宇, 陆月明. 软件定义网络抗拒绝服务攻击的流表溢出防护[J]. 通信学报, 2023, 44(2): 1-11.
[14]	康海燕, 龙墨澜. 基于吸收马尔可夫链攻击图的网络攻击分析方法研究[J]. 通信学报, 2023, 44(2): 122-135.
[15]	张云涛, 方滨兴, 杜春来, 王忠儒, 崔志坚, 宋首友. 基于异构观测链的容器逃逸检测方法[J]. 通信学报, 2023, 44(1): 49-63.