Identification of malicious code variants based on image visualization

Abstract The recent increases in Internet use and the number of malicious attacks are helping attackers generate malware variants through automated software. Because of these attacks, the amount of malware and the number of their variants are continuously increasing. Consequently, an improved malware analysis is a critical requirement to stop the rapid expansion of malicious activities. In this study, we propose a more accurate and slightly faster model to characterize malware variants. To implement the proposed model, we designed a method for transforming a malware binary into a grayscale image. We then propose the use of collective local and global malicious patterns for efficient malware variant identification. To reduce the computational time, the total number of dimensions of both types of patterns is reduced using selection methods. In addition, we prepared a baseline to compare the classification performance of our proposed model with previous state-of-the-art malware detection techniques. The experimental results indicate that the response time and classification performance of our model are better than those of previous models.