Malware analysis using visualized image matrices.

Area of Science:

• Computer Science
• Cybersecurity
• Digital Forensics

Background:

• Malware analysis is crucial for cybersecurity.
• Existing methods struggle with packed and obfuscated malware.
• Visual analysis offers a novel approach to malware identification.

Purpose of the Study:

• To propose a novel malware visual analysis method.
• To enable accurate malware classification using image similarity.
• To address challenges posed by packed malware samples.

Main Methods:

• Converting binary files into RGB-colored image matrices using opcode sequences.
• Calculating image similarity based on colored pixel information.
• Applying the method to execution traces from dynamic analysis for packed malware.
• Optimizing image generation by extracting opcodes from key behavioral blocks (functions, API calls).
• Generating representative images per malware family to reduce classification comparisons.

Main Results:

• The proposed method achieves high accuracy in malware family classification.
• Static analysis accuracy reached 0.9896.
• Dynamic analysis accuracy reached 0.9732.
• The visualization and similarity calculation are effective for packed malware.

Conclusions:

• Malware image matrices are effective for both static and dynamic analysis.
• The method provides a robust approach to malware classification.
• Visual analysis offers a promising direction for future malware detection research.