Space Filling Curve Mapping for Malware Detection and Classification
Zhuojun Ren, Guang Chen, Wenke Lu · 2020
Shannon entropy can reflect whether malware is encrypted or compressed, so it is important that security analysts can locate obfuscated regions by higher-entropy values. Moreover, malware files belonging to the same families share similar modules that can be shown in the form of entropy. So we present a new method that uses space filling curve mapping (SFCM) to visualize malware, extracts image features by using the deep convolution neural networks and classifies the generated images by SVM (support vector machine) classifier. We verified the proposed method with 7162 samples of 24 Kaspersky malware families, and obtained 99.44% detection accuracy and 98.56% classification accuracy.