The byte stream is widely used in malware detection due to its independence of reverse engineering.However,existing methods based on the byte stream implement an indiscriminate feature extraction strategy,which ignore...The byte stream is widely used in malware detection due to its independence of reverse engineering.However,existing methods based on the byte stream implement an indiscriminate feature extraction strategy,which ignores the byte function difference in different segments and fails to achieve targeted feature extraction for various byte semantic representation modes,resulting in byte semantic confusion.To address this issue,an enhanced adversarial byte function associated method for malware backdoor attack is proposed in this paper by categorizing various function bytes into three functions involving structure,code,and data.The Minhash algorithm,grayscale mapping,and state transition probability statistics are then used to capture byte semantics from the perspectives of text signature,spatial structure,and statistical aspects,respectively,to increase the accuracy of byte semantic representation.Finally,the three-channel malware feature image is constructed based on different function byte semantics,and a convolutional neural network is applied for detection.Experiments on multiple data sets from 2018 to 2021 show that the method can effectively combine byte functions to achieve targeted feature extraction,avoid byte semantic confusion,and improve the accuracy of malware detection.展开更多
Last August, a well-prepared exhibition titled "Chinese Scripts: From Oracle Bones to Computer Bytes" opened in Beijing-based Chinese Modern Literature Museum. This exhibition toured Egypt last October as a ...Last August, a well-prepared exhibition titled "Chinese Scripts: From Oracle Bones to Computer Bytes" opened in Beijing-based Chinese Modern Literature Museum. This exhibition toured Egypt last October as a cultural event in celebration of the opening of China Cultural Center in Egypt. After that, it will be displayed in France, Malta and the Republic of Korea.展开更多
基金This work is supported in part by the Information Security Software Project(2020)of the Ministry of Industry and Information Technology,PR China under Grant CEIEC-2020-ZM02-0134.
文摘The byte stream is widely used in malware detection due to its independence of reverse engineering.However,existing methods based on the byte stream implement an indiscriminate feature extraction strategy,which ignores the byte function difference in different segments and fails to achieve targeted feature extraction for various byte semantic representation modes,resulting in byte semantic confusion.To address this issue,an enhanced adversarial byte function associated method for malware backdoor attack is proposed in this paper by categorizing various function bytes into three functions involving structure,code,and data.The Minhash algorithm,grayscale mapping,and state transition probability statistics are then used to capture byte semantics from the perspectives of text signature,spatial structure,and statistical aspects,respectively,to increase the accuracy of byte semantic representation.Finally,the three-channel malware feature image is constructed based on different function byte semantics,and a convolutional neural network is applied for detection.Experiments on multiple data sets from 2018 to 2021 show that the method can effectively combine byte functions to achieve targeted feature extraction,avoid byte semantic confusion,and improve the accuracy of malware detection.
文摘Last August, a well-prepared exhibition titled "Chinese Scripts: From Oracle Bones to Computer Bytes" opened in Beijing-based Chinese Modern Literature Museum. This exhibition toured Egypt last October as a cultural event in celebration of the opening of China Cultural Center in Egypt. After that, it will be displayed in France, Malta and the Republic of Korea.
