├── Image_based_Malware_Classification_using_CNN (1).ipynb ├── Images ├── block.png └── conversion.png ├── LICENSE ├── README.md └── dataRaw ├── 0A32eTdBKayjCWhZqDOQ.bytes ├── 0A32eTdBKayjCWhZqDOQ.bytes.png ├── 0ACDbR5M3ZhBJajygTuf.bytes └── 0ACDbR5M3ZhBJajygTuf.bytes.png /Images/block.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TanayBhadula/malware-image-detection/20098036e15198fb1780e093ea8a558add746f0f/Images/block.png -------------------------------------------------------------------------------- /Images/conversion.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TanayBhadula/malware-image-detection/20098036e15198fb1780e093ea8a558add746f0f/Images/conversion.png -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2022 Tanay Bhadula 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | # :desktop_computer: Image-based Malware Classification using CNN 3 | 4 | ## Introduction 5 | Analyzing a huge amount of malware is a major burden for security analysts.Malware 6 | developers have been highly successful in evading signature-based detection techniques. 7 | Most of the prevailing static analysis techniques involve a tool to parse the executable, and 8 | extract features or signatures. Most of the dynamic analysis techniques involve the binary file 9 | to be run in a sand-boxed environment to examine its behaviour. This can be easily thwarted 10 | by hiding the malicious activities of the file if it is being run inside a virtual environment. 11 | Hence, there has been a need to explore new approaches to overcome the limitations of static 12 | or dynamic analysis such as time intensity, resource consumption, scalability. 13 | 14 | We propose a method for visualizing and classifying malware using image processing 15 | techniques. Malware binaries are visualized as gray-scale images, with the observation that 16 | for many malware families, the images belonging to the same family appear very similar in 17 | layout and texture. By converting the executable into an image representation, we have made 18 | our analysis process free from the problems faced by standard static and dynamic analyses 19 | 20 | ## Dataset Used 21 | For the training and evaluation of our proposed model we have used the Malimg Dataset. The Malimg Dataset contains 9349 malware images, belonging to 25 families/classes. Thus, 22 | our goal is to perform a multi-class classification of malware. 23 | 24 | Link - https://drive.google.com/drive/folders/1CnFx26NfWfQchIU85wRNfHjqfk7Up6hl?usp=sharing 25 | 26 | A Malware can belong to one of the following class : 27 | * Adialer.C 28 | * Agent.FYI 29 | * Allaple.A 30 | * Allaple.L 31 | * Alueron.gen!J 32 | * Autorun.K 33 | * C2LOP.P 34 | * C2LOP.gen!g 35 | * Dialplatform.B 36 | * Dontovo.A 37 | * Fakerean 38 | * Instantaccess 39 | * Lolyda.AA1 40 | * Lolyda.AA2 41 | * Lolyda.AA3 42 | * Lolyda.AT 43 | * Malex.gen!J 44 | * Obfuscator.AD 45 | * Rbot!gen 46 | * Skintrim.N 47 | * Swizzor.gen!E 48 | * Swizzor.gen!I 49 | * VB.AT 50 | * Wintrim.BX 51 | * Yuner.A 52 | 53 | ## Converting malware binaries to gray-scale images 54 | 55 | To convert the binary files into gray scale images we make use of the hexadecimal representation of the file's binary content and convert those files 56 | into PNG images. For example the resulting image after converting the **0ACDbR5M3ZhBJajygTuf.bytes** binary file into a **PNG**. 57 | 58 |

59 | binary to gray scale 60 |

61 | 62 | ## CNN Model Architecture 63 | CNN model includes following layers to make it perform feature and pattern extractions from images and help classify the malware family. 64 | * Convolutional Layer : 30 filters, (3 * 3) kernel size 65 | * Max Pooling Layer : (2 * 2) pool size 66 | * Convolutional Layer : 15 filters, (3 * 3) kernel size 67 | * Max Pooling Layer : (2 * 2) pool size 68 | * DropOut Layer : Dropping 25% of neurons. 69 | * Flatten Layer 70 | * Dense/Fully Connected Layer : 128 neurons, Relu activation function 71 | * DropOut Layer : Dropping 50% of neurons. 72 | * Dense/Fully Connected Layer : 50 neurons, Softmax activation function 73 | * Dense/Fully Connected Layer : num_class neurons, Softmax activation function 74 | 75 | The input has a shape of **[64 * 64 * 3] : [width * height * depth]**. In our case, each Malware is 76 | a RGB image. 77 | 78 | ## Block Diagram 79 |

80 | Block Diagram 81 |

82 | 83 | ## Future Work 84 | * Future work will be focused on conducting results using more advanced CNN models like Inception V3, VGG16-Net, ResNet50, CNN-SVM, MLP-SVM ,GRU-SVM etc. 85 | * We also want to convert malware images into color RGB images before classification to enhance the accuracy and precision. 86 | * We also want to implement a web based or GUI based tool to convert malware binary files into images and then classifying them. 87 | -------------------------------------------------------------------------------- /dataRaw/0A32eTdBKayjCWhZqDOQ.bytes.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TanayBhadula/malware-image-detection/20098036e15198fb1780e093ea8a558add746f0f/dataRaw/0A32eTdBKayjCWhZqDOQ.bytes.png -------------------------------------------------------------------------------- /dataRaw/0ACDbR5M3ZhBJajygTuf.bytes.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/TanayBhadula/malware-image-detection/20098036e15198fb1780e093ea8a558add746f0f/dataRaw/0ACDbR5M3ZhBJajygTuf.bytes.png --------------------------------------------------------------------------------