检索结果-内蒙古大学图书馆

MobileNet-Based IoT Malware Detection with opcode Features

Journal of Communications and Information Networks 2023年第3期8卷 221-230页

作者： Changren Mai Riqing Liao Jing Ren Yuanxiang Gong Kaibo Zhang Chiya Zhang Harbin Institute of Technology Shenzhen 518055China University of Electronic Science and Technology of China Chengdu 611731China

In recent years,with the rapid development of Internet and hardware technologies,the number of Internet of things(IoT)devices has grown ***,IoT devices are constrained by power consumption,making the security of IoT *** such as Botnets and Worms poses significant security threats to users and enterprises *** learning models have demonstrated strong performance in various tasks across different domains,leading to their application in malicious software ***,due to the power constraints of IoT devices,the well-performanced large models are not suitable for IoT malware *** this paper we propose a malware detection method based on Markov images and MobileNet,offering a cost-effective,efficient,and high-performing solution for malware ***,this paper innovatively analyzes the robustness of opcode sequences.

关键词： deep learning feature fusion malware detection opcode lightweight model

来源：评论

学校读者我要写书评

暂无评论

A feature-hybrid malware variants detection using CNN based opcode embedding and BPNN based API embedding

引用

COMPUTERS & SECURITY 2019年 84卷 376-392页

作者： Zhang, Jixin Qin, Zheng Yin, Hui Ou, Lu Zhang, Kehuan Hunan Univ Coll Informat Sci & Engn Changsha Hunan Peoples R China Chinese Univ Hong Kong Dept Informat Engn Hong Kong Peoples R China Changsha Univ Coll Comp Sci & Technol Changsha Hunan Peoples R China

Being able to detect malware variants is a critical problem due to the potential damages and the fast paces of new malware variations. According to surveys from McAfee and Symantec, there is about 69 new instances of malware detected in every minutes, and more than 50% of them are variants of existing ones. Such a large volume of diversified malware variants has forced researches to investigate new methods based on common behavior patterns using machine learning. However, such methods only use single type of features such as opcode, system call, etc., which faces several drawbacks: Firstly, the methods lose a part of useful information since different types of features show different characteristics of malware. This severely limits detection precision and recall. Secondly, the accuracy and the speed (as a trade-off) of such methods fail to meet users' expectation. Thirdly, the precise classification of malware families is still a hard problem and is also important in malware analysis. In this work, we propose a feature-hybrid malware variants detection approach which integrates multi-types of features to address these challenges. We first represent opcodes by a bi-gram model and represent API calls by a vector of frequency, then we use principal component analysis to optimize the representations to improve the convergence speed, the next we adopt a convolutional neural network and a back-propagation neural network for opcode based feature embedding and API based feature embedding respectively, and finally we embed these features to train a detection model by using softmax. Theoretical analysis and real-life experimental results show the efficiency and optimization of our approach which achieves more than 95% malware detection accuracy and almost 90% classification accuracy of malware families. The detection speed of our approach is less than 0.1 s. (C) 2019 Elsevier Ltd. All rights reserved.

关键词： API call Back-propagation neural network Convolutional neural network Feature-hybrid Malware variants detection Malware family classification opcode

来源：评论

学校读者我要写书评

暂无评论

opcode sequence analysis of Android malware by a convolutional neural network

引用

CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE 2020年第18期32卷 e5308-e5308页

作者： Li, Dan Zhao, Lichao Cheng, Qingfeng Lu, Ning Shi, Wenbo Northeastern Univ Sch Comp Sci & Engn Shenyang Peoples R China State Key Lab Math Engn & Adv Comp Zhengzhou Peoples R China Xidian Univ Sch Comp Sci & Technol Xian Peoples R China Northeastern Univ Qinhuangdao Sch Comp & Commun Engn Qinhuangdao 066004 Hebei Peoples R China

The number of malware has exploded due to the openness of the Android platform, and the endless stream of malware poses a threat to the privacy, tariffs, and device of mobile phone users. A novel Android mobile malware detection system is proposed, which employs an optimized deep convolutional neural network to learn from opcode sequences. The optimized convolutional neural network is trained multiple times by the raw opcode sequences extracted from the decompiled Android file, so that the feature information can be effectively learned and the malicious program can be detected more accurately. More critically, thek-max pooling method with better results is adopted in the pooling operation phase, which improves the detection effect of the proposed method. The experimental results show that the detection system achieved the accuracy of 99%, which is 2%-11% higher than the accuracy of the machine learning detection algorithms when using the same data set. It also ensures that the indicators, such as F1-score, recall, and precision, are maintained above 97%. Based on the detection system, a multi-data set comparison experiment is carried out. The introducedk-max pooling is deeply studied, and the effect ofkofk-max pooling on the overall detection effect is observed.

关键词： Android malware classification convolutional neural network k-max pooling opcode

来源：评论

学校读者我要写书评

暂无评论

Detecting Vulnerability in Hardware Description Languages: opcode Language Processing

引用

IEEE EMBEDDED SYSTEMS LETTERS 2024年第2期16卷 222-226页

作者： Ayar, Alaaddin Goktug Sahruri, Abdullah Aygun, Sercan Moghadam, Mehran Shoushtari Najafi, M. Hassan Margala, Martin Univ Louisiana Lafayette Sch Comp & Informat Lafayette LA 70503 USA

Detecting vulnerable code blocks has become a highly popular topic in computer-aided design, especially with the advancement of natural language processing (NLP). Analyzing hardware description languages (HDLs), such as Verilog, involves dealing with lengthy code. This letter introduces an innovative identification of attack-vulnerable hardware by the use of opcode processing. Leveraging the advantage of architecturally defined opcodes and expressing all operations at the beginning of each code line, the word processing problem is efficiently transformed into opcode processing. This research converts a benchmark dataset into an intermediary code stack, subsequently classifying secure and fragile codes using NLP techniques. The results reveal a framework that achieves up to 94% accuracy when employing sophisticated convolutional neural networks (CNNs) architecture with extra embedding layers. Thus, it provides a means for users to quickly verify the vulnerability of their HDL code by inspecting a supervised learning model trained on the predefined vulnerabilities. It also supports the superior efficacy of opcode-based processing in Trojan detection by analyzing the outcomes derived from a model trained using the HDL dataset.

关键词： Codes Hardware design languages Trojan horses Hardware C++ languages Integrated circuits Benchmark testing Convolutional neural networks (CNNs) deep learning hardware description language (HDL) hardware security natural language processing (NLP) opcode

来源：评论

学校读者我要写书评

暂无评论

opcode Sequence Amplifier using Sequence Generative Adversarial Networks 10

Opcode Sequence Amplifier using Sequence Generative Adversar...

引用

10th International Conference on Information and Communication Technology Convergence (ICTC) - ICT Convergence Leading the Autonomous Future

作者： Choi, Changhee Shin, Sunguk Lee, Inseop Agcy Def Dev Daejeon South Korea

ISBN: (纸本)9781728108933

Weapon systems and military networks are threatened by increased cyber attacks. In case of usual cyber attack, commercial grade defence systems are available. Because of speciality of military system, cyber attacks for them are also special and the number is extremely small. For machine learning based defence system, the shortage of malware samples is critical problem. To solve this problem, we proposed the new method for amplifying opcode sequence which is part of the malware and used for malware detection. We first extract opcode sequences from malwares and benign portable files. To make them meaningful and easy to learn, whole opcode sequence is split into several blocks, called OPSEN(opcode SENtence), using special delimiters. Considering that opcode sequence is not a numerical data but a sequence of instruction, we used SeqGAN with stochastic policy in reinforcement learning and policy gradient. The experimental results shows that the proposed amplified opcode sequence help to improve the detection rate.

关键词： opcode malware GAN SeqGAN malware family

来源：评论

学校读者我要写书评

暂无评论

Identification of malicious android app using manifest and opcode features

引用

JOURNAL OF COMPUTER VIROLOGY AND HACKING TECHNIQUES 2017年第2期13卷 125-138页

作者： Varsha, M. V. Vinod, P. Dhanya, K. A. SCMS Sch Engn & Technol Dept Comp Sci & Engn Ernakulam Kerala India Amrita Vishwa Vidyapeetham Univ Amrita Sch Engn Ctr Cyber Secur Coimbatore Tamil Nadu India

In this paper, we propose a statistical approach for smartphone malware detection. A set of features such as hardware, permission, application components, filtered intents, opcodes and strings are extracted from the samples to form a vector space model. Feature selection methods such as Entropy based Category Coverage Difference (ECCD) and Weighted Mutual Information (WI) are used to choose the prominent features. The performance of the system is analyzed using classifiers, Random Forest, Rotation Forest and Support Vector Machine (SVM). The system was evaluated on individual models as well as Meta feature space model for both malware and benign features. It was observed that the meta feature space model with malware features provide the best results for both feature selection. For ECCD, Random Forest classifier performs better [Dataset 1-0.972, Dataset 2-0.976 and Dataset 3-0.969] whereas in the case of WI, SVM gives highest F-measure [Dataset 1-0.993, Dataset 2-0.994 and Dataset 3-0.992]. From the overall analysis on the system, we conclude that the malware model outperforms it's benign counterpart and also that WI is a better feature selection technique compared to ECCD.

关键词： Android malware Manifest opcode Strings Feature selection Meta feature Classifier

来源：评论

学校读者我要写书评

暂无评论

Unknown Malcode Detection Using opcode Representation

Unknown Malcode Detection Using OPCODE Representation

引用

1st European Conference on Intelligence and Security Informatics

作者： Moskovitch, Robert Feher, Clint Tzachar, Nir Berger, Eugene Gitelman, Marina Dolev, Shlomi Elovici, Yuval Ben Gurion Univ Negev Deutsch Telekom Labs IL-84105 Beer Sheva Israel

ISBN: (纸本)9783540898993

The recent growth in network usage has motivated the creation of new malicious code for various purposes, including economic ones. Today's signature-based anti-viruses are very accurate, but cannot detect new malicious code. Recently, classification algorithms were employed successfully for the detection of unknown malicious code. However, most of the studies use byte sequence n-grams representation of the binary code of the executables. We propose the use of (Operation Code) opcodes, generated by disassembling the executables. We then use n-grams of the opcodes as features for the classification process. We present a full methodology for the detection of unknown malicious code, based on text categorization concepts. We performed an extensive evaluation of a test collection of more than 30,000 files, in which we evaluated extensively the opcode n-gram representation and investigated the imbalance problem, referring to real-life scenarios, in which the malicious file content is expected to be about 10% of the total files. Our results indicate that greater than 99% accuracy can be achieved through the use of a training set that has a malicious file percentage lower than 15%, which is higher than in our previous experience with byte sequence n-gram representation [1].

关键词： Malicious Code Detection opcode Classification

来源：评论

学校读者我要写书评

暂无评论

A New Method for Malware Detection Using opcode Visualization 19

A New Method for Malware Detection Using Opcode Visualizatio...

引用

19th CSI International Symposium on Artificial Intelligence and Signal Processing (AISP)

作者： Manavi, Farnoush Hamzeh, Ali Shiraz Univ Dept Comp Sci & Engn & IT Shiraz Iran

ISBN: (纸本)9781538625859

Malware is a program that is developed with malicious purpose, such as sabotage the computer system, information theft or other malicious actions. Various methods have been defined for detecting and classifying malware. This paper proposes a new malware detection method based on the opcodes within an executable file by using image processing techniques. In opcode level, the proposed method shows promising results with less complexity in comparison with previous studies. There are several steps in the proposed method, which includes generating a graph of operational codes (opcodes) from an executable file and converting this graph to an image and then using "GIST" method in order to extract features from each image. In the final step machine learning methods such as Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Ensemble are used for classification.

关键词： Classification Ensemble Image KNN Malware opcode SVM

来源：评论

学校读者我要写书评

暂无评论

Malware Detection Based on opcode Sequence and ResNet 2nd

Malware Detection Based on Opcode Sequence and ResNet

引用

2nd International Conference on Security with Intelligent Computing and Big-data Services (SICBS)

作者： Zhang, Xuetao Sun, Meng Wang, Jiabao Wang, Jinshuang Army Engn Univ PLA Dept Cyberspace Secur Nanjing 210000 Jiangsu Peoples R China

ISBN: (纸本)9783030169466;9783030169459

Nowadays, it is challenging for traditional static malware detection method to keep pace with the rapid development of malware variants, therefore machine learning based malware detection approaches begin to flourish. Typically, operation codes disassembled from binary programs were sent to classifiers e.g. SVM and KNN for classification recognition. However, this feature extraction method does not make full use of sequence relations between opcodes, at the same time, the classification model still has less dimensions and lower matching ability. Therefore, a malware detection model based on residual network was proposed in this paper. Firstly, the model extracts the opcode sequences using the disassembler. To improve the vector's expressibility of opcodes, Word2Vec strategy was used in the representation of opcodes, and word vector representations of opcodes were also optimized in the process of training iteration. Unfortunately, the overlapping opcode matrix and convolution operation results in information redundancies. To overcome this problem, a method of downsampling to organize opcode sequences into opcode matrix was adopted, which can effectively control the time and space complexity. In order to improve the classification ability of the model, a classifier with more layers and cross-layer connection was proposed to match malicious code in more dimensions based on ResNet. The experiment shows that the malware classification accuracy in this paper is 98.2%. At the same time, the processing time consumption comparing with traditional classifiers is still negligible.

关键词： opcode N-gram ResNet Word2vec

来源：评论

学校读者我要写书评

暂无评论

Deep Neural Network Based on Android Mobile Malware Detection System Using opcode Sequences 18

Deep Neural Network Based on Android Mobile Malware Detectio...

引用

18th IEEE International Conference on Communication Technology (IEEE ICCT)

作者： Zhao, Lichao Li, Dan Zheng, Guangcong Shi, Wenbo Northeastern Univ Coll Comp Sci & Engn Shenyang Liaoning Peoples R China Northeastern Univ Qinhuangdao Sch Comp & Commun Engn Qinhuangdao Peoples R China

ISBN: (纸本)9781538676356

Malware detection is more challenging due to the increase in android malicious programs and the current problems of android malicious detection. This paper proposes an android mobile malware detection system based on deep neural network, a novel malware detection method which uses optimized deep Convolutional Neural Network to learn from opcode sequences. In the proposed detection system, the optimized Convolutional Neural Network is trained multiple times by the raw operation code sequence extracted from the decompiled android file, so that the feature information can be effectively learned and the malicious program can be detected more accurately. More critically, the k-max pooling method with better results was adopted in the pooling operation phase, and which improves the detection effect of the proposed method. The experimental results show that the detection system achieved the accuracy of 99%, which is 2%-11% higher than the accuracy of the machine learning detection algorithms when using the same dataset. It also ensures that the indicators such as F1-score, Recall and Precision are maintained above 97%.

关键词： malware detection opcode k-max pooling Convolutional Neural Network

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：