바이너리 시각화와 기계학습을 이용한 악성코드 분류

초록

The number of variants of malware is rapidly increasing. This can be attributed to reasons such as reuse of existing code and evolution of malware generation tools. Therefore, it is important to classify variants of malware accurately and quickly. The current malware classification system used whether binary file includes certain byte sequence in itself but these signature based malware classifications has difficulties in classifying variants of malware. This paper proposes a new method for classifying variants of malware. To classify variants of malware, it creates a fixed size image from malware binary file. The value of each byte of the binary is used as a coordinate and the two byte data is associated with the <x, y> coordinates, and the value of the pixel corresponding to each coordinate in the image is increased. The image feature information generated in this way is utilized for machine learning. The machine learning methods used in malware classification are random forest, convolutional neural network and the experiments of each classification method on 10868 malware samples resulted with high accuracy of 98.9% and 97.1% respectively.

키워드