Malware Classification with Markov Transition Field Encoded Images

Abstract

Malicious software (Malware) has been growing exponentially recently. And it is urgently need to identify Malware from normal software. As Malware samples can be represented as byteplot grayscale images. Thus, deep transfer learning is a proper method for Malware images classification. However, the Malware samples do not possess the vertical direction structure as image. It is more like one dimensional signal and we can convert Malware to a Malware signal. Thus, we try to extract some feature vector from Malware signal. Then we can use SVM to train a model to detect Malware file. Recently, Markov Transition Field (MTF) can encode time series as images for visual inspection and classification. We can try to adapt MTF to encode the Malware signal to MTF image. Then we reshape MTF as a one-dimensional vector for SVM to train a model. Our proposed method is better than the byteplot grayscale image based method in our dataset. And our proposed MTF based two classes Malware detection method can be used for Malware software detection in reality.