Scholarlink

Malware can be defined as a computer program that somehow causes damage to assets once it is executed. There are several types of malware, the most common being downloaders, keyloggers, miners, ransomware, rootkits, and spyware. Each of them has its own behavior and characteristics, and, in some cases, malware can be classified into more than one type due to its characteristics. Malware is typically written in structures with a greater number of utilities, aiming to affect as many assets as possible. One of the most used formats is PE32, which belongs to the object standard of the Microsoft Windows operating system family, where they have been available as executables or binaries. Its structure comprises MS-DOS 2.0 compatible EXE header, OEM identifier, a PE header, Section headers, and Image pages (import, export, and resource information). There are some techniques for analyzing this type of file, and one example is to use a sandbox to emulate the program and map key points, such as memory and file system, to identify malicious behavior. Another way is by using disassembly techniques to verify the program’s intention based on actions. Although these techniques are largely used by the malware research community, by default, they tend to be time-consuming or require considerable manual labor. On the other hand, there is research that aims to apply the use of deep learning to identify types of malware written in PE32 format, using disassembly techniques to recover the functions of the binary file and applying convolutional neural network (CNN) techniques to identify patterns in the use of these functions from malware. This current research proposes to go further, using disassembly techniques to extract functions and files from Microsoft Windows operating systems. After that, a dataset is structured with the extracted data, and a lexical interpretation structure based on word2vec is fostered, aiming to identify types of functions by malware types. Then, the idea is to use the results as input for a deep learning model with long short-term memory (LSTM) techniques, which are widely used as CNN substitutes. LTSM will map the patterns and create a model to identify new inputs (with the same structure) as the malware types of the original training. Using the word2vec model and the LSTM model within a docker structure, it is possible to analyze malware samples and identify their type from a portable environment, easy-lift, and communicating in an open source and well-known pattern.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Method to Automate the Classification of PE32 Malware Using Word2vec and LSTM

  • 章节

  • 发表日期：

    2025年

查看全文
  • Bruce William Percílio Azevedo,
  • Robson de Oliveira Albuquerque,
  • Luis Javier García Villalba

摘要

Malware can be defined as a computer program that somehow causes damage to assets once it is executed. There are several types of malware, the most common being downloaders, keyloggers, miners, ransomware, rootkits, and spyware. Each of them has its own behavior and characteristics, and, in some cases, malware can be classified into more than one type due to its characteristics. Malware is typically written in structures with a greater number of utilities, aiming to affect as many assets as possible. One of the most used formats is PE32, which belongs to the object standard of the Microsoft Windows operating system family, where they have been available as executables or binaries. Its structure comprises MS-DOS 2.0 compatible EXE header, OEM identifier, a PE header, Section headers, and Image pages (import, export, and resource information). There are some techniques for analyzing this type of file, and one example is to use a sandbox to emulate the program and map key points, such as memory and file system, to identify malicious behavior. Another way is by using disassembly techniques to verify the program’s intention based on actions. Although these techniques are largely used by the malware research community, by default, they tend to be time-consuming or require considerable manual labor. On the other hand, there is research that aims to apply the use of deep learning to identify types of malware written in PE32 format, using disassembly techniques to recover the functions of the binary file and applying convolutional neural network (CNN) techniques to identify patterns in the use of these functions from malware. This current research proposes to go further, using disassembly techniques to extract functions and files from Microsoft Windows operating systems. After that, a dataset is structured with the extracted data, and a lexical interpretation structure based on word2vec is fostered, aiming to identify types of functions by malware types. Then, the idea is to use the results as input for a deep learning model with long short-term memory (LSTM) techniques, which are widely used as CNN substitutes. LTSM will map the patterns and create a model to identify new inputs (with the same structure) as the malware types of the original training. Using the word2vec model and the LSTM model within a docker structure, it is possible to analyze malware samples and identify their type from a portable environment, easy-lift, and communicating in an open source and well-known pattern.