Study of Appropriate Information Combination in Image-based Obfuscated Malware Detection
Tetsuro Takahashi, Rikima Mitsuhashi, Masakatsu Nishigaki, Tetsushi Ohki · 2025
Obfuscation is an evasion technique that compresses or encrypts malware. To counter the threat of obfuscated malware, many researchers have proposed image-based malware detection. However, previous studies have not sufficiently investigated the information combination for including in images and accuracy in mixed environments with both obfuscated benign and malware. In this study, we propose a method for detecting mal-ware by combining images generated from byte values, entropy, semantic information, and bigrams in Windows PE files. Malware detection using images is evaluated in a mixed environment of obfuscated and non-obfuscated files. Using images combining four information types, we achieved 88% detection accuracy in the mixed environment. The results show that the combination of information is highly effective in detecting obfuscated malware.