Data augmentation based malware detection using convolutional neural networks

Çatak, Ferhat Özgür; Ahmed, Javed; Şahinbaş, Kevser; Khand, Zahid Hussain

Data augmentation based malware detection using convolutional neural networks

dc.contributor.author	Çatak, Ferhat Özgür
dc.contributor.author	Ahmed, Javed
dc.contributor.author	Şahinbaş, Kevser
dc.contributor.author	Khand, Zahid Hussain
dc.date.accessioned	2021-02-26T08:02:42Z
dc.date.available	2021-02-26T08:02:42Z
dc.date.issued	2021
dc.department	İstanbul Medipol Üniversitesi, İşletme ve Yönetim Bilimleri Fakültesi, Yönetim Bilişim Sistemleri Bölümü
dc.description.abstract	Due to advancements in malware competencies, cyber-attacks have been broadly observed in the digital world. Cyber-attacks can hit an organization hard by causing several damages such as data breach, financial loss, and reputation loss. Some of the most prominent examples of ransomware attacks in history are WannaCry and Petya, which impacted companies’ finances throughout the globe. Both WannaCry and Petya caused operational processes inoperable by targeting critical infrastructure. It is quite impossible for anti-virus applications using traditional signature-based methods to detect this type of malware because they have different characteristics on each contaminated computer. The most important feature of this type of malware is that they change their contents using their mutation engines to create another hash representation of the executable file as they propagate from one computer to another. To overcome this method that attackers use to camouflage malware, we have created three-channel image files of malicious software. Attackers make different variants of the same software because they modify the contents of the malware. In the solution to this problem, we created variants of the images by applying data augmentationmethods. This article aims to provide an image augmentation enhanced deep convolutional neural network (CNN) models for detecting malware families in a metamorphic malware environment. The main contributions of the article consist of three components, including image generation from malware samples, image augmentation, and the last one is classifying the malware families by using a CNN model. In the first component, the collected malware samples are converted into binary file to 3-channel images using the windowing technique. The second component of the system create the augmented version of the images, and the last part builds a classification model. This study uses five different deep CNNmodel formalware family detection. The results obtained by the classifier demonstrate accuracy up to 98%, which is quite satisfactory.
dc.identifier.citation	Çatak, F. Ö., Ahmed, J., Şahinbaş, K. ve Khand, Z. H. (2021). Data augmentation based malware detection using convolutional neural networks. PeerJ Computer Science, 7, 1-26. https://dx.doi.org/10.7717/PEERJ-CS.346
dc.identifier.doi	10.7717/PEERJ-CS.346
dc.identifier.endpage	26
dc.identifier.issn	2376-5992
dc.identifier.scopusquality	Q2
dc.identifier.startpage	1
dc.identifier.uri	https://dx.doi.org/10.7717/PEERJ-CS.346
dc.identifier.uri	https://hdl.handle.net/20.500.12511/6585
dc.identifier.volume	7
dc.identifier.wosquality	Q3
dc.indekslendigikaynak	Web of Science
dc.indekslendigikaynak	Scopus
dc.indekslendigikaynak	PubMed
dc.language.iso	en
dc.publisher	PeerJ Inc.
dc.relation.ispartof	PeerJ Computer Science	en_US
dc.relation.publicationcategory	Makale - Uluslararası Hakemli Dergi - Kurum Öğretim Elemanı
dc.rights	Attribution 4.0 International	*
dc.rights	info:eu-repo/semantics/openAccess
dc.rights.uri	https://www.creativecommons.org/licenses/by/4.0/	*
dc.subject	Convolutional Neural Networks
dc.subject	Cybersecurity
dc.subject	Image Augmentation
dc.subject	Malware Analysis
dc.title	Data augmentation based malware detection using convolutional neural networks
dc.type	Article