Semantic lossless encoded image representation for malware classification.

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Malware classification faces challenges due to anti-analysis techniques like code packing, which obscure original semantics.
• Existing methods convert bytecode to images but suffer from data truncation and loss of detail.
• Pre-trained code language models are ineffective against obfuscated malicious code.

Purpose of the Study:

• To develop a lossless encoding method for visualizing malicious code that preserves semantic integrity.
• To enhance the classification of obfuscated malware by addressing limitations of current image-based approaches.
• To improve feature extraction by combining local and global contextual information.

Main Methods:

• Bytecode files are converted into semantically lossless images with proportional width.
• Image interleaving encoding is employed to prevent semantic truncation and information loss.
• A multi-scale feature extraction module and modified Transformer architecture are used for local and global feature extraction.

Main Results:

• The proposed method achieves unrestricted processing of malicious code images of any size.
• It effectively preserves original code information, avoiding issues from cropping and compression.
• Experimental results on diverse malware datasets demonstrate superior classification performance.

Conclusions:

• The developed lossless encoding and feature extraction method offers a robust solution for classifying obfuscated malicious code.
• This approach significantly enhances the effectiveness of AI in cybersecurity by preserving crucial code semantics.
• The method provides a foundation for more accurate and reliable malware detection systems.