• Journal of Internet Computing and Services
• /
• v.23 no.1
• /
• pp.87-93
• /
• 2022

Since 99% of PCs operating in the defense domain use the Windows operating system, detection and response of Window-based malware is very important to keep the defense cyberspace safe. This paper proposes a model capable of detecting malware in a Windows PE (Portable Executable) format. The detection model was designed with an emphasis on rapid update of the training model to efficiently cope with rapidly increasing malware rather than the detection accuracy. Therefore, in order to improve the training speed, the detection model was designed based on a Bidirectional LSTM (Long Short Term Memory) network that can detect malware with minimal sequence data without complicated pre-processing. The experiment was conducted using the EMBER2018 dataset, As a result of training the model with feature sets consisting of three type of sequence data(Byte-Entropy Histogram, Byte Histogram, and String Distribution), accuracy of 90.79% was achieved. Meanwhile, it was confirmed that the training time was shortened to 1/4 compared to the existing detection model, enabling rapid update of the detection model to respond to new types of malware on the surge.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.05a
• /
• pp.431-434
• /
• 2020

본 논문에서는 악성코드탐지 기법으로 n-grams를 사용한 특징 추출을 통해 이미지 인식 분야에서 널리 쓰이는 Convolutional Neural Network로 학습하는 프레임워크를 제안한다. 윈도우즈 실행 파일의 PE 포맷에서 특징을 추출하여 6-grams 확률을 구하고 grayscale 을 통해 이미지로 변환한다. 이것을 기존에 연구된 탐지방법과 비교하여 우수함을 보인다. 학습에 사용된 데이터는 총 55,000개로 5-folds 교차검증을 하였으며 예측 정확도는 98.87%였다.