基于图像特征融合的恶意代码检测

doi:10.3969/j.issn.1671-1122.2021.10.013

信息网络安全 ›› 2021, Vol. 21 ›› Issue (10): 90-95.doi: 10.3969/j.issn.1671-1122.2021.10.013

基于图像特征融合的恶意代码检测

谭茹涵¹^,²(), 左黎明¹^,², 刘二根¹, 郭力¹^,²

1.华东交通大学理学院,南昌 330013
2.华东交通大学系统工程与密码学研究所,南昌 330013

收稿日期:2021-06-15 出版日期:2021-10-10 发布日期:2021-10-14
通讯作者: 谭茹涵 E-mail:1018647895@qq.com
作者简介:谭茹涵（1997—）,女,江西,硕士研究生,主要研究方向为信息安全|左黎明（1981—）,男,江西,副教授,硕士,主要研究方向为信息安全|刘二根（1965—）,男,江西,教授,硕士,主要研究方向为图论|郭力（1996—）,女,江西,硕士研究生,主要研究方向为信息安全
基金资助:
江西省教育厅科学技术研究项目(GJJ200626)

Malicious Code Detection Based on Image Feature Fusion

TAN Ruhan¹^,²(), ZUO Liming¹^,², LIU Ergen¹, GUO Li¹^,²

1. School of Science, East China Jiaotong University, Nanchang 330013, China
2. SEC Institute, East China Jiaotong University, Nanchang 330013, China

Received:2021-06-15 Online:2021-10-10 Published:2021-10-14
Contact: TAN Ruhan E-mail:1018647895@qq.com

摘要/Abstract

摘要：

随着恶意代码混淆技术的不断升级,传统检测方法已不能满足安全需求。文章提出了一种基于图像特征融合的恶意代码检测方法,采用加权的HOG特征对B2M算法转换后的恶意代码进行局部纹理特征提取,根据恶意代码不同段落位置对分类的影响力度不同,分别赋予不同的权重。同时,采用Dense SIFT提取全局纹理结构特征,将局部纹理特征和全局纹理结构特征两者进行融合,既可以反映恶意代码的细节特征,又不忽视整体的结构特性。利用SVM对提取后的特征进行分类检验,实验结果表明,融合特征的性能优于单一特征。

关键词: 加权HOG, Dense SIFT特征, 特征融合, SVM

Abstract:

With the continuous upgrading of malicious code obfuscation technology, the traditional detection methods are not enough to meet the security requirements. A malicious code detection method based on image feature fusion was proposed in this paper. The weighted-HOG features were used to extract the local texture features of the malicious code converted by B2M algorithm, and different weights were given according to the influence of different paragraph positions of malicious code on classification. At the same time, the Dense SIFT was used to extract the global texture structure features, which could not only reflect the detail of malicious code, but also not ignore the overall structure characteristics. SVM was used to classify the extracted features. The experimental results show that the performance of combined features is better than that of single features.

Key words: weighted-HOG, Dense SIFT features, feature fusion, SVM

中图分类号:

TP309

谭茹涵, 左黎明, 刘二根, 郭力. 基于图像特征融合的恶意代码检测[J]. 信息网络安全, 2021, 21(10): 90-95.

TAN Ruhan, ZUO Liming, LIU Ergen, GUO Li. Malicious Code Detection Based on Image Feature Fusion[J]. Netinfo Security, 2021, 21(10): 90-95.

图/表 9

图1

图2

表1

图3

图4

图5

图6

表2

表3

参考文献 15

[1]	SZOMSZOR M N, CANTADOR I, ALANI H. Correlating User Profiles from Multiple Folksonomies [C]//ACM. 19th ACM Conference on Hypertext and Hypermedia, June 19-21, 2008, Pittsburgh, USA. New York: ACM, 2008: 33-42.
[2]	BAN M. Ransomware Detection Using Random Forest Technique[J]. ICT Express, 2020, 6(4):325-331. doi: 10.1016/j.icte.2020.11.001 URL
[3]	TAKEUCHI Y, SAKAI K, FUKUMOTO S. Detecting Ransomware Using Support Vector Machines[C]//ICPP. 47th International Conference on Parallel Processing Companion (ICPP'18), August 13-16, 2018, Eugene, USA. New York: ACM, 2018(1): 1-6.
[4]	FIRDAUSI I, LIM C, ERWIN A, et al. Analysis of Machine Learning Techniques Used in Behavior-based Malware Detection[M]. Piscataway: IEEE Computer Society, 2010.
[5]	SHAUKAT S K, RIBEIRO V J. RansomWall: A Layered Defense System Against Cryptographic Ransomware Attacks Using Machine Learning [C]//IEEE. 2018 10th International Conference on Communication Systems & Networks (COMSNETS), January 3-7, 2018, Bengaluru, India. Piscataway: IEEE, 2018: 356-363.
[6]	SUBEDI K, BUDHATHOKI D, DASGUPTA D. Forensic Analysis of Ransomware Families Using Static and Dynamic Analysis [C]//IEEE. 2018 IEEE Security and Privacy Workshops (SPW), May 24-26, 2018, San Francisco, USA. Piscataway: IEEE, 2018: 180-185.
[7]	KANG Minggu, POOSANKAM P, YIN Heng. Renovo: A Hidden Code Extractor for Packed Executables [C]//ACM. 5th ACM Workshop on Recurring Malcode, November 2-3, 2007, Alexandria, USA. New York: ACM, 2007: 46-53.
[8]	ROYAL P, HALPIN M, DAGON D, et al. PolyUnpack: Automating the Hidden-code Extraction of Unpack-executing Malware [C]//IEEE. 22nd Computer Security Applications Conference, December 11-15, 2006, Miami, USA. Piscataway: IEEE, 2006: 289-300.
[9]	CUI Hong, YU Bo, FANG Ying. Analytical Method of High-dimensional Feature Fusion for Malware Classification[J]. Application Research of Computers, 2017, 34(4):1120-1123, 1150.
	崔弘, 喻波, 方莹. 恶意代码分类的一种高维特征融合分析方法[J]. 计算机应用研究, 2017, 34(4):1120-1123, 1150.
[10]	JIANG Qianyu, WANG Fengying, JIA Lipeng. Malware Detection Method Based on Perceptual Hash Algorithm and Feature Fusion[J]. Journal of Computer Applications, 2021, 41(3):780-785.
	姜倩玉, 王凤英, 贾立鹏. 基于感知哈希算法和特征融合的恶意代码检测方法[J]. 计算机应用, 2021, 41(3):780-785.
[11]	NATARAJ L, KARTHIKEYAN S, JACOB G, et al. Malware Images: Visualization and Automatic Classification[C]//VizSec. 8th International Symposium on Visualization for Cyber Security (VizSec'11), July 20-21, 2011, New York, USA. New York: ACM, 2011(4): 1-7.
[12]	HAN Xiaoguang, QU Wu, YAO Xuanxia, et al. Research on Malicious Code Variants Detection Based on Texture Fingerprint[J]. Journal on Communications, 2014, 35(8):125-136.
	韩晓光, 曲武, 姚宣霞, 等. 基于纹理指纹的恶意代码变种检测方法研究[J]. 通信学报, 2014, 35(8):125-136.
[13]	LOWE D G. Distinctive Image Features from Scale-invariant Keypoints[J]. International Journal of Computer Vision, 2004, 60(2):91-110. doi: 10.1023/B:VISI.0000029664.99615.94 URL
[14]	DALAL N, TRIGGS B. Histograms of Oriented Gradients for Human Detection[C]//IEEE. IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR'5), June 20-25, 2005, San Diego, USA. Piscataway: IEEE, 2005(1): 886-893.
[15]	LIU Zhigang, LI Deren, QIN Qianqing, et al. An Analytical Overview of Methods for Multi-category Support Vector Machines[J]. Computer Engineering and Applications, 2004, 40(7):10-13, 65.
	刘志刚, 李德仁, 秦前清, 等. 支持向量机在多类分类问题中的推广[J]. 计算机工程与应用, 2004, 40(7):10-13, 65.

恶意代码家族	训练集数量/个	测试集数量/个
Ramnit	626	97
Lolipop	825	99
Kelihos_ver3	852	100
Vundo	424	88
Simda	42	37
Tracur	563	93
Kelihos_ver1	353	89
ObfuscatorACY	668	87
Gatak	635	95
总数量	4988	785

特征组合	SVM/%	RF/%	KNN/%	DT/%	LR/%
1_HOG（原始HOG）特征	78.99	80.25	41.38	22.26	16.60
3_HOG特征	88.68	85.41	53.33	29.94	28.81
5_HOG特征	90.44	86.79	52.70	34.59	30.82
7_HOG特征	90.06	88.30	60.88	43.27	32.20
Dense SIFT	91.57	92.58	79.62	49.06	48.55
1_HOG+Dense SIFT	90.18	91.45	71.95	49.05	50.69
3_HOG+Dense SIFT	92.57	92.33	78.36	49.18	49.94
5_HOG+Dense SIFT	93.08	92.96	81.76	49.81	50.94
7_HOG+Dense SIFT	94.46	93.84	80.00	51.19	51.95

方法	特征	准确率/%
文献[9]的方法	GLCM	85.8
文献[10]的方法	Gist+LBP	93.4
本文方法	HOG+Dense SIFT	94.5

基于图像特征融合的恶意代码检测

Malicious Code Detection Based on Image Feature Fusion

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 15

相关文章 9

编辑推荐

Metrics

本文评价

[1]	潘孝勤, 杜彦辉. 基于混合特征和多通道GRU的伪造语音鉴别方法[J]. 信息网络安全, 2021, 21(10): 1-7.
[2]	顾兆军, 郝锦涛, 周景贤. 基于改进双线性卷积神经网络的恶意网络流量分类算法[J]. 信息网络安全, 2020, 20(10): 67-74.
[3]	张戈琳, 李勇. 非负矩阵分解算法优化及其在入侵检测中的应用[J]. 信息网络安全, 2018, 18(8): 73-78.
[4]	李红灵, 邹建鑫. 基于SVM和文本特征向量提取的SQL注入检测研究[J]. 信息网络安全, 2017, 17(12): 40-46.
[5]	曲洋, 王永剑, 彭如香, 姜国庆. 基于通联数据的人际关系网络构建与挖掘[J]. 信息网络安全, 2016, 16(6): 68-73.
[6]	. Linux下基于SVM分类器的WebShell检测方法研究[J]. , 2014, 14(5): 5-.
[7]	李振军;程杰仁. 基于多特征分布式拒绝服务攻击的检测[J]. , 2013, 13(5): 0-0.
[8]	赵晶玲;张乃斌;崔宝江;兰芸. Hadoop DDos攻击检测算法分析[J]. , 2013, 13(12): 0-0.
[9]	赵光耀;邹鹏;韩伟红. 基于遗传算法和LSSVM的网络安全事件发生频率预测[J]. , 2010, (10): 0-0.