A Multi-channel Visualization Method for Malware Classification Based on Deep Learning

Abstract

The traditional malware classification method relies too much on expert extraction features, and the malware image visualization method contains fewer features. To deal with these problems, we propose a multi-channel visualization method for malware classification based on deep learning. Firstly, the malware binary file is divided into a 256×256-dimensional matrix according to the width of 256 bytes. Secondly, the Word2Vec algorithm is used to calculate the 256-dimensional vector of each byte in each binary file, and then the file is converted to a 256×256-dimensional matrix. Thirdly, we use the Word2Vec algorithm to calculate the 256-dimensional vector of each assembly instruction in each assembly file, and then the file is converted into a 256×256-dimensional matrix. Fourthly, for each malware sample, 3 matrixes are combined into an uncompressed multi-channel image. Finally, the LeNet5 is used for training classification model. The experimental results show that the average accuracy is 98.76%.