Malware images

TLDR

Malware binaries can be visualized as gray‑scale images, and malware families tend to produce visually similar images. The study proposes a simple, image‑based method to visualize and classify malware using standard image features. The method extracts standard image features from gray‑scale visualizations of malware binaries. The approach achieves 98% accuracy on 9,458 samples across 25 families, requires no disassembly or execution, and remains robust to obfuscation such as section encryption.

Abstract

We propose a simple yet effective method for visualizing and classifying malware using image processing techniques. Malware binaries are visualized as gray-scale images, with the observation that for many malware families, the images belonging to the same family appear very similar in layout and texture. Motivated by this visual similarity, a classification method using standard image features is proposed. Neither disassembly nor code execution is required for classification. Preliminary experimental results are quite promising with 98% classification accuracy on a malware database of 9,458 samples with 25 different malware families. Our technique also exhibits interesting resilience to popular obfuscation techniques such as section encryption.