A Malicious Code Family Classification Method Based on RGB Images and Lightweight Model

In recent years, malware attacks have been a constant threat to network security, and the problem of how to classify malicious code families quickly and accurately urgently needs to be addressed. Traditional malicious code family classification methods are affected by the proliferation of variants to lead to failure and are no longer adequate for the current stage of research. The visualization method can maximize the malicious code core performance on the image, and the grayscale image has the problem of few and single features. In this paper, we propose a new malicious code visualization method. Specifically, we first convert the original malicious file into a byte file and an asm file using the IDA Pro tool. Secondly, we extract the opcode sequences in the asm file and the byte sequences in the byte file and convert them into a three-channel RGB image by using visualization techniques, which allows for a more comprehensive representation of the features of the malicious sample. Finally, we propose a new neural network architecture, the MobileNetV2 lightweight model combined with Convolutional Block Attention Module (MVCBAM) approach for training and prediction. In addition, we conduct various contrast experiments on the BIG2015 dataset and the Malimg dataset. The Experiments show that the classification accuracy of our proposed model on the two datasets is 99.90 \(\%\) and 99.95 \(\%\) , and the performance of our proposed model was maintained with fewer network parameters than the original MobileNetV2 model and has higher accuracy and faster speed than other advanced methods.