Malware Analysis Using Image Classification Techniques

Abstract

These days, almost every device like mobile phones, laptops to large systems such as power grid and nuclear plants are subjected to cyberattacks. Among serious cyber threats, malware-borne threats evolve daily and have the capacity to disrupt both IT and OT systems. A typical antivirus software uses primitive approaches such as generation of signatures of known malware beforehand and then comparing newly downloaded executables against these signatures to detect malware. In recent years, the malware authors have been highly successful in evading signature-based detection techniques. However, machine-learning-based malware detection and classification have gained a lot of importance in recent time. Machine learning methods extract features from binaries using different types of analyses. Static analysis does not execute the binary, but parses the binary to extract features such as use of APIs, size of different sections, etc. The malware authors evade static-analysis-based feature extraction by code obfuscation, packing, and encryption. Therefore, dynamic analysis techniques extract features by letting the code execute in a sandbox and collecting information on runtime activities. The dynamic analysis techniques can be somehow evaded by detecting the sandbox environment and not executing any abnormal or malicious activities inside the sandbox. Therefore, there is an urgent need to find a new approach to overcome the shortcomings of static or dynamic analysis. In this chapter, we discuss an approach to analyze malware for Windows and Linux executables using image representation of the binaries.