A comparative assessment of malware classification using binary texture analysis and dynamic analysis

TLDR

AI and machine‑learning methods are increasingly used to classify malware, but existing dynamic‑feature approaches face countermeasures, high extraction costs, and scalability limits, prompting the development of binary‑texture analysis. This study compares binary‑texture analysis to previously published malware classification methods. The authors evaluated the methods on three independent malware corpora totaling over 100 000 samples. Binary‑texture analysis achieves comparable accuracy to dynamic techniques while being 4000 × faster, resilient to packing, and capable of robustly classifying both packed and unpacked malware, making it a valuable complement to dynamic analysis.

Abstract

AI techniques play an important role in automated malware classification. Several machine-learning methods have been applied to classify or cluster malware into families, based on different features derived from dynamic review of the malware. While these approaches demonstrate promise, they are themselves subject to a growing array of counter measures that increase the cost of capturing these binary features. Further, feature extraction requires a time investment per binary that does not scale well to the daily volume of binary instances being reported by those who diligently collect malware. Recently, a new type of feature extraction, used by a classification approach called binary-texture analysis, was introduced in [16]. We compare this approach to existing malware classification approaches previously published. We find that, while binary texture analysis is capable of providing comparable classification accuracy to that of contemporary dynamic techniques, it can deliver these results 4000 times faster than dynamic techniques. Also surprisingly, the texture-based approach seems resilient to contemporary packing strategies, and can robustly classify a large corpus of malware with both packed and unpacked samples. We present our experimental results from three independent malware corpora, comprised of over 100 thousand malware samples. These results suggest that binary-texture analysis could be a useful and efficient complement to dynamic analysis.