Browse > Article
http://dx.doi.org/10.5762/KAIS.2020.21.9.634

A Study on Classification of CNN-based Linux Malware using Image Processing Techniques  

Kim, Se-Jin (Division of Information Security, Hoseo University)
Kim, Do-Yeon (Division of Information Security, Hoseo University)
Lee, Hoo-Ki (Department of Cyber Security Engineering, Konyang University)
Lee, Tae-Jin (Division of Information Security, Hoseo University)
Publication Information
Journal of the Korea Academia-Industrial cooperation Society / v.21, no.9, 2020 , pp. 634-642 More about this Journal
Abstract
With the proliferation of Internet of Things (IoT) devices, using the Linux operating system in various architectures has increased. Also, security threats against Linux-based IoT devices are increasing, and malware variants based on existing malware are constantly appearing. In this paper, we propose a system where the binary data of a visualized Executable and Linkable Format (ELF) file is applied to Local Binary Pattern (LBP) image processing techniques and a median filter to classify malware in a Convolutional Neural Network (CNN). As a result, the original image showed the highest accuracy and F1-score at 98.77%, and reproducibility also showed the highest score at 98.55%. For the median filter, the highest precision was 99.19%, and the lowest false positive rate was 0.008%. Using the LBP technique confirmed that the overall result was lower than putting the original ELF file through the median filter. When the results of putting the original file through image processing techniques were classified by majority, it was confirmed that the accuracy, precision, F1-score, and false positive rate were better than putting the original file through the median filter. In the future, the proposed system will be used to classify malware families or add other image processing techniques to improve the accuracy of majority vote classification. Or maybe we mean "the use of Linux O/S distributions for various architectures has increased" instead? If not, please rephrase as intended.
Keywords
Linux Malware; Machine Learning; CNN; LBP; Median Filter; Majority Voting Classifiers;
Citations & Related Records
Times Cited By KSCI : 6  (Citation Analysis)
연도 인용수 순위
1 Muhammad Furqan Rafique, Muhammad Ali, Aqsa Saeed Qureshi, Asifullah Khan, Jin Young Kim, Anwar Majid Mirza, "Malware Classification using Deep Learning based Feature Extraction and Wrapper based Feature Selection Technique", 2019
2 KISA & KrCERT, "2016 Mirai Malware Trends Report", Technical report, KISA, Republic of Korea, pp. 2-8
3 B. N. Noh, Embedded Linux based IoT device malware analysis technology research, Technical Report, KISA, Korea, pp. 1-7
4 Hongbi, Kim, Hyunseok, Shin, Junho, Hwang, Taejin, Lee, "Malware Variants Detection based on Dhash", Journal of KIISE, Vol. 46, No. 11, pp. 1207-1214, 2019.11 DOI : https://dx.doi.org/10.5626/JOK.2019.46.11.1207   DOI
5 Jun-ho, Hwang, Tae-jin, Lee, "Study of Static Analysis and Ensemble-Based Linux Malware Classification", Journal of The Korea Institute of Information Security & Cryptology, VOL. 29, NO. 6, pp. 1327-1337, Dec. 2019 DOI : https://dx.doi.org/10.13089/JKIISC.2019.29.6.1327   DOI
6 Seon-hee, Seok, Ho-won, Kim, "Visualized Malware Classification Based-on Convolutional Neural Network", Journal of The Korea Institute of Information Security & Cryptology, VOL. 26, NO. 1, pp. 197-208, Feb. 2016 DOI : https://dx.doi.org/10.13089/JKIISC.2016.26.1.197   DOI
7 L. Nataraj, S. Karthikeyan, G. Jacob, and B. S. Manjunath, "Malware images: visualization and automatic classification," Proc. of the 8th international symposium on visualization for cyber security, pp. 1-7, 2011 DOI : https://dx.doi.org/10.1145/2016904.2016908
8 Jiawei Su, Danilo Vasconcellos Vargas, Sanjiva Prasad, Daniele Sgandurra, Yaokai Feng, Kouichi Sakurai, "Lightweight Classification of IoT Malware based on Image Recognition", 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), 2018 DOI : https://dx.doi.org/10.1109/COMPSAC.2018.10315
9 Geun-Youngm, Lim, Young-Bok, Cho, "Dynamic RNN-CNN malware clasifer corespond with Random Dimension Input Data", Journal of the Korea Instiute of Information and Comunication Enginering, Vol. 23, No. 5, pp. 533-539, May 2019
10 Ho-Sung, Woo, Geon-Ung, Cheong, Jun-Woo-Cho, Jae-Hyun, Kim, "Antivirus Software Using CNN", Proceedings of Symposium of the Korean Institute of communications and Information Sciences, pp. 385-386, 2018.11
11 Tae-Guen, Kim, Hwan-Tae, Ji, Eul-Gyu, Im, "Malware Classification Using Machine Learning and Binary Visualization", KIISE Transactions on Computing Practices, Vol. 24, No. 4, pp. 198-203, 2018.4 DOI : https://dx.doi.org/10.5626/KTCP.2018.24.4.198   DOI
12 Wei-Chung, Huang, Fabio Di Troia, Mark Stamp, "Robust Hashing for Image-based Malware Classification", Proceedings of the 15th International Joint Conference on e-Business and Telecommunications (ICETE 2018), Vol. 1, pp. 451-459, 2018. DOI: https://dx.doi.org/10.5220/0006942204510459
13 Jhu-Sin, Luo, Dan, Lo, Malware Image Classification using Machine Learning with Local Binary Pattern, Master's thesis, Kennesaw State University of Computer Science, 2018.5 DOI : https://dx.doi.org/10.1109/TPAMI.2006.244
14 T. Ahonen, A. Hadid, M. Pietikainen, "Face Description with Local Binary Patterns: Application to Face Recognition", IEEE Transactions on Pattern Analysis and Machine Intelligence Vol. 28, Issue. 12 , pp. 2037-2041, Dec. 2006   DOI
15 Matti Pietikainen, Local Binary Patterns, Scholarpedia, 2010, http://www.scholarpedia.org/article/Local_Binary_Patterns (accessed Apr. 3, 2020)