Study of Appropriate Information Combination in Image-based Obfuscated Malware Detection
- 1. Study of Appropriate Information Combination in Image-based Obfuscated Malware Detection The 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Poster Track Tetsuro Takahashi | DSN2025 | 2025.6.24 Shizuoka Unviersity, Ohki Laboratory 1 of 11 Tetsuro Takahashi*, Rikima Mitsuhashi*, Masakatsu Nishigaki*, Tetsushi Ohki* *Shizuoka University
- 2. Background | Malware Obfuscation Malware uses obfuscation to evade malware detection Obfuscation modifies malware signature through various techniques • packing, encryption, etc. Due to obfuscation, the difficulty of detecting malware signatures has increased 2 of 11 before after Project Page
- 3. Background | Image-Based Malware Detection To tackle obfuscation, image-based malware detection has been proposed • Byte value, Entropy, etc. Existing methods have two limitations: • Remain limited by single information modalities • Overlook benign file obfuscation in realistic environments 3 of 11
- 4. Key Questions in Our Study • How effective is image-based malware detection in environments with diverse obfuscation techniques? • How does combining different types of information affect malware detection performance? 4 of 11
- 5. Contributions • We constructed a dataset that includes both obfuscated and non-obfuscated benign files and malware, reflecting realistic environments. • We evaluated an image-based method that integrates four types of information, demonstrating that information fusion improves malware detection performance to as high as 88.66%. 5 of 11
- 6. Proposed Method | Image Conversion • Executable PE files are converted into images representing four types of information: • Byte value • Entropy • Semantic information • Bigram frequency 6 of 11 Image Conversion Overview
- 7. Proposed Method | Malware Detection We extract high-level features from each type of image The extracted features are concatenated and fed into a binary classifier • Feature Extractor: EfficientNet-B0 • Binary Classifier: Random Forest 7 of 11 Malware Detection Framework
- 8. Evaluation | Dataset Dataset Sources: • Benign file ➢ DikeDataset ➢ dataset of packed PE files • Malware ➢ VirusShare Applied five tools of Obfuscation: • PECompact • PEtite • Themida • UPX 8 of 11 Dataset Configuration
- 9. Evaluation | Result • Accuracy of Single information Byte = Semantic > Entropy = BiGram • Combining all four information types achieved 88.66% accuracy • Combining Semantic infomation with other information (B,S・S,G) tends to increase specificity 9 of 11 Result
- 10. Evaluation | Discussion • Combining Semantic infomation with other information (B,S・S,G) tends to increase specificity Semantic information is • highly independent as a feature • improves specificity when combined with other types 10 of 11 Result
- 11. Future Work • We plan to explore more effective combinations by incorporating a wider variety of information. • This study considers only a limited set of obfuscation techniques. Future work should evaluate the proposed method using a broader range of techniques. 11 of 11