Opcode Features Research Articles

Obfuscated Computer Malware Classification Based on Significant Opcode

Computer malware has greatly impacted the computer network securities and even personal computer users. Signature-based detection is incapable to recognize the obfuscated computer malware since it is being covered by the obfuscation techniques. Therefore, machine learning is being explored and equipped in the malware detection to withstand the threaten of malware. In fact, there are many features available, i.e., text string to be implemented for malware classification. Nevertheless, opcode could be one of the features owing to its relative smaller data size compared to the text string. In this research, the significant opcodes of executable malware files which referring to the prevalent content from malware-to-malware generation are extracted as training dataset. Several machine learning classifiers are generated and compared in terms of classification accuracy and speed, as well as the comparison is done with text string-based detection and signature-based detection. From the finding, it is shown that machine learning detection performs more than 2 times better than signature based and machine learning generated based-on significant opcode features is able to detect obfuscated malware over 10 times faster than text string feature and still achieve up to 98% of accuracy.

CAIMP: Cross-Architecture IoT Malware Detection and Prediction Based On Static Feature

Abstract IoT malware and cross-platform malware are currently the top threats to information systems. This paper proposes a robust cross-architecture IoT malware detection and prediction model based on machine learning and opcode features using a novel approach. In our method, a feature opcode transformation model between chip architecture platforms is proposed to facilitate the process of building a detection model for cross-architecture malware on IoT devices. The feature transformation model is capable of converting opcodes between different architecture platforms using an unsupervised machine learning approach. In our approach, a machine learning model is used for the detection of cross-platform malware based on the proposed opcode features. Experiments have demonstrated that our method is effective in detecting and predicting cross-platform malware with an accuracy of up to 99.4% and an F1-score of 99.3%. The method is capable of learning on one architecture platform and detecting malware on a different architecture platform. Therefore, the method can be used to develop cross-architecture detection and zero-day malware prediction solutions on IoT devices.

Android malware detection framework based on sensitive opcodes and deep reinforcement learning

Malware attack is a growing problem on the Android mobile platform due to its popularity and openness. Although numerous malware detection approaches have been proposed, it still remains challenging for malware detection due to a large amount of constantly mutating apps. The opcode, as the most fundamental part of Android app, possesses good resistance against obfuscation and Android version updates. Due to the large number of opcodes, most opcode-based methods employ statistical-based feature selection, which disrupts the correlation and semantic information among opcodes. In this paper, we propose an Android malware detection framework based on sensitive opcodes and deep reinforcement learning. Firstly, we extract sensitive opcode fragments based on sensitive elements and then encode the features using n-gram. Next, we use deep reinforcement learning to select the optimal subset of features. During the process of handling opcodes, we focus on preserving semantic information and the correlation among opcodes. Finally, our experimental results show an accuracy of 0.9670 by using the 25 opcode features we obtained.

MobileNet-Based IoT Malware Detection with Opcode Features

MobileNet-Based IoT Malware Detection with Opcode Features

SimCoDe-NET: Similarity Detection in Binary Code using Deep Learning Network

Binary code similarity detection is a fundamental task in the field of computer binary security. However, code similarity is crucial today because of the prevalence of issues like plagiarism, code cloning, and recycling in software due to the ongoing increase of software scale. To resolve these issues, a novel SIMilarity detection in binary COde using DEep learning NETwork (SimCoDe-NET) has been proposed. Initially, op-code features are extracted from the input data by using reverse engineering process and the opcode embedding is generated using N-skip gram method. The extracted features are fed into Bi-GRU neural network for classifying the similarity of the binary codes. The Bi-GRU neural network compares two data samples in feature space to identify whether they belong to similar data or non-similar data. The SimCoDe-NET framework is evaluated by using generated dataset to assess the efficiency of this method. The efficacy of the proposed SimCoDe-NET framework is assessed in terms of precision, accuracy, sensitivity, recall, similarity detection time and similarity detection rate. The accuracy of the proposed method is 99.10% which is relatively high compared to the existing method. The proposed SimCoDe-NET approach improves the accuracy by 84.9%, 88.58%, and 93.9% better than jTrans, UPPC, and HEBCS respectively.

A Hybrid Attention Network for Malware Detection Based on Multi-Feature Aligned and Fusion

With the widespread use of computers, the amount of malware has increased exponentially. Since dynamic detection is costly in both time and resources, most existing malware detection methods are based on static features. However, existing static methods mainly rely on single feature types of malware, while few pay attention to multi-feature fusion. This paper presents a novel multi-feature extraction and fusion method to effectively detect malware variants by combining binary and opcode features. We propose a stacked convolutional network to capture the temporal and discontinuity information in the function call of the binary file from malware. Additionally, we adopt the triangular attention algorithm to extract code-level features from assembly code. Additionally, these two extracted features are aligned and fused by the cross-attention, which could provide a stable feature representation. We evaluate our method on two different datasets. It achieves an accuracy of 0.9954 on the Kaggle Malware Classification dataset and an accuracy of 0.9544 on a large real-world dataset. To optimize our detection model, we conduct in-depth discussions on different feature extractors and multi-feature fusion strategies. Moreover, a visualized attention module in our model is provided to explain its superiority in the opcode feature extraction. An experimental analysis is performed against five baseline deep learning models and five state-of-the-art malware detection models, which reveals that our strategy outperforms competing approaches in all evaluation circumstances.

Detecting Ethereum Ponzi Schemes Through Opcode Context Analysis and Oversampling-Based AdaBoost Algorithm

Due to the anonymity of blockchain, frequent security incidents and attacks occur through it, among which the Ponzi scheme smart contract is a classic type of fraud resulting in huge economic losses. Machine learning-based methods are believed to be promising for detecting ethereum Ponzi schemes. However, there are still some flaws in current research, e.g., insufficient feature extraction of Ponzi scheme smart contracts, without considering class imbalance. In addition, there is room for improvement in detection precision. Aiming at the above problems, this paper proposes an ethereum Ponzi scheme detection scheme through opcode context analysis and adaptive boosting (AdaBoost) algorithm. Firstly, this paper uses the n-gram algorithm to extract more comprehensive contract opcode features and combine them with contract account features, which helps to improve the feature extraction effect. Meanwhile, adaptive synthetic sampling (ADASYN) is introduced to deal with class imbalanced data, and integrated with the Adaboost classifier. Finally, this paper uses the improved AdaBoost classifier for the identification of Ponzi scheme contracts. Experimentally, this paper tests our model in real-world smart contracts and compares it with representative methods in the aspect of F1-score and precision. Moreover, this article compares and discusses the state of art methods with our method in four aspects: data acquisition, data preprocessing, feature extraction, and classifier design. Both experiment and discussion validate the effectiveness of our model.

DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection

As Android malware grows and evolves, deep learning has been introduced into malware detection, resulting in great effectiveness. Recent work is considering hybrid models and multi-view learning. However, they use only simple features, limiting the accuracy of these approaches in practice. This study proposes DeepCatra, a multi-view learning approach for Android malware detection, whose model consists of a bidirectional LSTM (BiLSTM) and a graph neural network (GNN) as subnets. The two subnets rely on features extracted from statically computed call traces leading to critical APIs derived from public vulnerabilities. For each Android app, DeepCatra first constructs its call graph and computes call traces reaching critical APIs. Then, temporal opcode features used by the BiLSTM subnet are extracted from the call traces, while flow graph features used by the GNN subnet are constructed from all call traces and inter-component communications. We evaluate the effectiveness of DeepCatra by comparing it with several state-of-the-art detection approaches. Experimental results on over 18,000 real-world apps and prevalent malware show that DeepCatra achieves considerable improvement, for example, 2.7%–14.6% on the F1 measure, which demonstrates the feasibility of DeepCatra in practice.

Malware classification with Word2Vec, HMM2Vec, BERT, and ELMo

Malware classification is an important and challenging problem in information security. Modern malware classification techniques rely on machine learning models that can be trained on features such as opcode sequences, API calls, and byte n-grams, among many others. In this research, we consider opcode features and we implement machine learning techniques, where we apply word embedding techniques—specifically, Word2Vec, HMM2Vec, BERT, and ELMo—as a feature engineering step. The resulting embedding vectors are then used as features for classification algorithms. The classification algorithms that we employ are support vector machines (SVM), k-nearest neighbor (kNN), random forests (RF), and convolutional neural networks (CNN). We conduct substantial experiments involving seven malware families. Our experiments extend beyond previous related work in this field. We show that we can obtain slightly better performance than in comparable previous work, with significantly faster model training times.

Android malware obfuscation variants detection method based on multi-granularity opcode features

Android malware poses a serious security threat to ordinary mobile users. However, the obfuscation technology can generate malware variants, which can bypass existing detection methods and significantly reduce detection accuracy. Aiming at the detection of Android malware obfuscation variants, we propose an efficient anti-obfuscation Android malware detection system MGOPDroid. For different obfuscation technologies, MGOPDroid extracts opcode features with different granularities, combines the TFIDF algorithm and the difference index of opcode feature distribution before and after obfuscation to calculates the weight of opcode features. Then we convert the opcode features into the sequences according to the opcode encoding mapping rules and convert the sequences into grayscale images to achieve feature visualization. A deep learning detection model combined with image enhancement, Resnet, and global average pooling layer is designed to detect malware variants. What is more, MGOPDroid can be deployed on mobile devices, supports real-time monitoring of application installation and update behavior, and automatically detect malware. Experiments show that the malware detection accuracy for unobfuscated samples is 96.35%, and is 94.55% for the obfuscated malware. And malware family classification accuracy is 95.31%, while after obfuscating, the classification accuracy rate is 89.96%. On mobile devices, the average time to detect a single application is 3.211 s. Compared with the previous advanced methods, MGOPDroid has obvious advantages in anti-obfuscation effect and efficiency.

Malware classification based on double byte feature encoding

Many researchers analyze malware through static analysis and dynamic analysis technology, and combine it with excellent deep learning algorithm, which has achieved good results in malware classification. However, many researches only use the. ASM file generated by decompiler or. Bytes file represented by hexadecimal for feature extraction. This paper fully integrates the features of these two files, and uses word frequency and two deep learning algorithms to extract 184 opcode features and 16 probability features from ASM file and section file of Kaggle dataset respectively. Then, double byte feature coding method is used to fuse the features of the two files. Finally, convolution neural network is used to classify the fused samples. The experimental results show that the accuracy is 98.68% and the logarithm loss is 0.022.

BMOP: Bidirectional Universal Adversarial Learning for Binary OpCode Features

For malware detection, current state-of-the-art research concentrates on machine learning techniques. Binaryn-gram OpCode features are commonly used for malicious code identification and classification with high accuracy. Binary OpCode modification is much more difficult than modification of image pixels. Traditional adversarial perturbation methods could not be applied on OpCode directly. In this paper, we propose a bidirectional universal adversarial learning method for effective binary OpCode perturbation from both benign and malicious perspectives. Benign features are those OpCodes that represent benign behaviours, while malicious features are OpCodes for malicious behaviours. From a large dataset of benign and malicious binary applications, we select the most significant benign and malicious OpCode features based on the feature SHAP value in the trained machine learning model. We implement an OpCode modification method that insert benign OpCodes into executables as garbage codes without execution and modify malicious OpCodes by equivalent replacement preserving execution semantics. The experimental results show that the benign and malicious OpCode perturbation (BMOP) method could bypass malicious code detection models based on the SVM, XGBoost, and DNN algorithms.

A new scheme of vulnerability analysis in smart contract with machine learning

The smart contracts deployed in Ethereum carry huge amounts of virtual coins. However, there are vulnerabilities in some of these smart contracts, which makes them vulnerable to malicious attacks. Due to the characteristics of blockchain, such vulnerable contracts are difficult to be revoked. In order to prevent vulnerable contracts, it is very important to detect the loopholes in these contracts before their deployment. In this paper, we focus on three vulnerabilities of smart contract: has_short_address, has_flows and is_greedy. For the three kinds of vulnerabilities, we propose slicing matrix, a new method to extract vulnerability feature, and construct three vulnerability detection models for comparison. The experimental results show that the detection accuracy based on neural network and slice matrix is better than that based on neural network and opcode features. In other words, slice matrix can improve the accuracy of vulnerable contract detection. Among our three detection models, the model based on random forest and opcode features performs best.

Machine Learning Framework to Analyze IoT Malware Using ELF and Opcode Features

Threats to devices that are part of the Internet of Things (IoT) are on the rise. Owing to the overwhelming diversity of IoT hardware and software, as well as its variants, conventional anti-virus techniques based on the Windows paradigm cannot be applied directly to counter threats to the IoT devices. In this article, we propose a framework that can efficiently analyze IoT malware in a wide range of environments. It consists of a universal feature representation obtained by static analysis of the malware and a machine learning scheme that first detects the malware and then classifies it into a known category. The framework was evaluated by applying it to a recently developed dataset consisting of more than 6,000 IoT malware samples collected from the HoneyPot project. The results show that the proposed method can obtain near-optimal accuracy in terms of the detection and classification of malware targeting IoT devices.

N-gram Opcode Analysis for Android Malware Detection

Android malware has been on the rise in recent years due to the increasing popularity of Android and the proliferation of third party application markets. Emerging Android malware families are increasingly adopting sophisticated detection avoidance techniques and this calls for more effective approaches for Android malware detection. Hence, in this paper we present and evaluate an n-gram opcode features based approach that utilizes machine learning to identify and categorize Android malware. This approach enables automated feature discovery without relying on prior expert or domain knowledge for pre-determined features. Furthermore, by using a data segmentation technique for feature selection, our analysis is able to scale up to 10-gram opcodes. Our experiments on a dataset of 2520 samples showed an f-measure of 98% using the n-gram opcode based approach. We also provide empirical findings that illustrate factors that have probable impact on the overall n-gram opcodes performance trends.

N-gram Opcode Analysis for Android Malware Detection

Android malware has been on the rise in recent years due to the increasing popularity of Android and the proliferation of third party application markets. Emerging Android malware families are increasingly adopting sophisticated detection avoidance techniques and this calls for more effective approaches for Android malware detection. Hence, in this paper we present and evaluate an n-gram opcode features based approach that utilizes machine learning to identify and categorize Android malware. This approach enables automated feature discovery without relying on prior expert or domain knowledge for pre-determined features. Furthermore, by using a data segmentation technique for feature selection, our analysis is able to scale up to 10-gram opcodes. Our experiments on a dataset of 2520 samples showed an f-measure of 98% using the n-gram opcode based approach. We also provide empirical findings that illustrate factors that have probable impact on the overall n-gram opcodes performance trends.

Identification of malicious android app using manifest and opcode features

In this paper, we propose a statistical approach for smartphone malware detection. A set of features such as hardware, permission, application components, filtered intents, opcodes and strings are extracted from the samples to form a vector space model. Feature selection methods such as Entropy based Category Coverage Difference (ECCD) and Weighted Mutual Information (WI) are used to choose the prominent features. The performance of the system is analyzed using classifiers, Random Forest, Rotation Forest and Support Vector Machine (SVM). The system was evaluated on individual models as well as Meta feature space model for both malware and benign features. It was observed that the meta feature space model with malware features provide the best results for both feature selection. For ECCD, Random Forest classifier performs better [Dataset 1—0.972, Dataset 2—0.976 and Dataset 3—0.969] whereas in the case of WI, SVM gives highest F-measure [Dataset 1—0.993, Dataset 2—0.994 and Dataset 3—0.992]. From the overall analysis on the system, we conclude that the malware model outperforms it’s benign counterpart and also that WI is a better feature selection technique compared to ECCD.