Efficacy of Nonlinear Manifold Learning in Malware Image Pattern Analysis

Identification and detection of malware is important in private and government agencies for defending against cyber attack on network security. Current methods for malware analysis achieves promising results using linear methods, such as, PCA. It is well-known that the underlying physical processes behind malware binaries to image conversion are highly nonlinear. Our work set out to understand the impact of malware image resolution on suitable neighborhood size over which to consider pattern phenomena, if nonlinear methods capture pattern phenomena with increased efficacy, and how they improve clustering and identification of malware. In real-life use cases, good clustering practice requires scientific and domain knowledge. As there is no rich domain history of malware image data, we set out to explore different clustering methods with reasoning. Image domains are typically high-dimensional and can have many instantiations. For this reason, statistical approaches to clustering can fail because low probability mass is associated with a single image. Moreover, related images will therefore have subtle differences as measured by their probabilities. We developed an information theoretic method for measurement of malware image resolutions and found that nonlinear methods are better in capturing underlying data regularity and give statistically significant improvement in clustering results than linear methods. This is the first application of nonlinear Manifold learning to malware image analysis in the research literature.