Data Augmentation Based Malware Detection using Convolutional Neural Networks

TL;DR

This paper proposes a novel malware detection method using image-based data augmentation and convolutional neural networks to classify malware families in a metamorphic environment, addressing limitations of signature-based detection.

Contribution

It introduces an image augmentation approach combined with CNN models for malware classification, enhancing detection accuracy in metamorphic malware scenarios.

Findings

Effective conversion of malware binaries into images.

Improved classification accuracy with augmented images.

Comparison of five CNN models for malware detection.

Abstract

Recently, cyber-attacks have been extensively seen due to the everlasting increase of malware in the cyber world. These attacks cause irreversible damage not only to end-users but also to corporate computer systems. Ransomware attacks such as WannaCry and Petya specifically targets to make critical infrastructures such as airports and rendered operational processes inoperable. Hence, it has attracted increasing attention in terms of volume, versatility, and intricacy. The most important feature of this type of malware is that they change shape as they propagate from one computer to another. Since standard signature-based detection software fails to identify this type of malware because they have different characteristics on each contaminated computer. This paper aims at providing an image augmentation enhanced deep convolutional neural network (CNN) models for the detection of malware families in a metamorphic malware environment. The main contributions of the paper's model structure consist of three components, including image generation from malware samples, image augmentation, and the last one is classifying the malware families by using a convolutional neural network model. In the first component, the collected malware samples are converted binary representation to 3-channel images using windowing technique. The second component of the system create the augmented version of the images, and the last component builds a classification model. In this study, five different deep convolutional neural network model for malware family detection is used.