PH-CNN for PE Malware Classification by Means of Enhanced Images

The method based on gray images and deep learning has become an effective solution to malware family classification. However, a major problem with the gray image is the ignorance of malware structure information and content information, resulting in poor classification accuracy. Moreover, deep learning requires a large number of parameters for computation, which is time-consuming in model classification. To solve these problems, we proposed gray image enhancement and usimg of CNN combined with perceptual basis (PH-CNN) as a classification model. Enhancing the original image by discarding the subjectively set machine codes and adding section distribution information, then using PH-CNN model to classify the enhanced image. The PH-CNN model consists of Perceptual Hashing classification module and CNN classification module. Malware images are first classified by Perceptual Hashing module to quickly divide the samples of specific malware families and uncertain malware families, and then, the samples of uncertain malware families are classified by the CNN classification module. The experimental results on Microsoft Malware Classification Challenge dataset show that our model using enhanced image achieves higher accuracy than the original gray image. In addition to that, the proposed model improves higher classification efficiency compared with only using CNN model.