The rapid increase in the number of malware and its variants poses a significant threat to internet security. While existing machine learning-based malware classification methods can improve accuracy, they often require complex feature engineering. In contrast, converting executable files into images and classifying them using deep learning models can reduce the reliance on prior knowledge of malware features and simplify the feature processing. However, most studies have not adequately considered the impact of image pixel features and size on classification results. In addition, the model structure of deep learning classification methods based on pre-trained parameters and transfer learning is usually more complex, resulting in the classification model requiring more memory and time overhead. To solve the above problems, this paper proposes a novel lightweight malware classification framework LMCF-FS driven by feature selection. This framework uses a proposed new feature selection method based on pixel pair features to improve feature sparsity and optimize image texture features, thereby improving feature expression capabilities. At the same time, an interpolation algorithm is used to balance the image size. In addition, a new lightweight malware classification model ConvInceptionNet is built based on the Inception-C module to balance accuracy, computational cost, and number of parameters, thereby improving malware classification efficiency. Our proposed LMCF-FS framework achieves a classification accuracy of 99.12% on the Microsoft Malware Classification Challenge Dataset (BIG2015 Dataset), and it only takes 0.92 ms to predict a 224  \(\times \)  224 malware image, verifying LMCF-FS effectiveness in dealing with malware classification.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

LMCF-FS: A Novel Lightweight Malware Classification Framework Driven by Feature Selection

  • Cui Yun,
  • Lei Zhou,
  • Shuangshuang Xing,
  • Ning Yang,
  • Pan Zhao,
  • Zhiguo Chen

摘要

The rapid increase in the number of malware and its variants poses a significant threat to internet security. While existing machine learning-based malware classification methods can improve accuracy, they often require complex feature engineering. In contrast, converting executable files into images and classifying them using deep learning models can reduce the reliance on prior knowledge of malware features and simplify the feature processing. However, most studies have not adequately considered the impact of image pixel features and size on classification results. In addition, the model structure of deep learning classification methods based on pre-trained parameters and transfer learning is usually more complex, resulting in the classification model requiring more memory and time overhead. To solve the above problems, this paper proposes a novel lightweight malware classification framework LMCF-FS driven by feature selection. This framework uses a proposed new feature selection method based on pixel pair features to improve feature sparsity and optimize image texture features, thereby improving feature expression capabilities. At the same time, an interpolation algorithm is used to balance the image size. In addition, a new lightweight malware classification model ConvInceptionNet is built based on the Inception-C module to balance accuracy, computational cost, and number of parameters, thereby improving malware classification efficiency. Our proposed LMCF-FS framework achieves a classification accuracy of 99.12% on the Microsoft Malware Classification Challenge Dataset (BIG2015 Dataset), and it only takes 0.92 ms to predict a 224  \(\times \)  224 malware image, verifying LMCF-FS effectiveness in dealing with malware classification.