CNN기반 악성코드 시각화를 이용한 악성코드 유형 분류 기법 = A Malware Classification Method By CNN-based Malware Visualization

다국어 초록 (Multilingual Abstract)

MS Thesis
A Malware Classification Method By CNN-based Malware Visualization
Honggeun Kim

Department of Computer Engineering
Graduate School of Engineering
Yeungnam University

(Supervised by Professor Byoungchul Ahn)

Abstract
Malware is created by a huge range of people every month. Many automatic detection software tools are developed to detect and remove malware. However, these tools have difficulty to analyze various malicious codes efficiently.
This paper proposes a method for classifying Malware without executing malicious codes or analyzing codes. This method converts malicious binary codes to 8-bit grayscale images by applying CNN (convolution natural network) as a deep learning neural networks. The proposed method shows 95% accuracy to classify 9 families for the Microsoft data set and 98% accuracy to classify 25 families for the malimg_dataset of Nataraj.
The proposed method does not require a complex process to find malicious codes but enables automatic detection by imaging malicious codes.

목차 (Table of Contents)

• 1. 서론 1
• 2. 관련 연구 4
• 2.1 악성코드 4
• 2.2 신경망 7
• 2.2.1 신경망 7
• 2.2.2 Convolution Neural Network 9
• 2.2.3 CNN방식 학습 알고리즘 14
• 2.3 악성코드 탐기 기법 연구 15
• 3. 제안 모델 19
• 3.1 악성코드 이미지 변환 19
• 3.2 악성코드 유형 분류 23
• 4. 실험 27
• 4.1 실험 환경과 방법 27
• 4.2 Dataset 28
• 4.3 Microsoft 데이터 셋 분류 실험 30
• 4.4 malimg_dataset 분류 실험 31
• 5. 평가 및 분석 33
• 5.1 오차행렬을 이용한 malware 유형 결과 분석 33
• 5.2 악성코드 샘플의 수와 분류 상관관계 41
• 5.3 타 모델 비교 분석 42
• 6. 결론 45
• 참고 문헌 47
• Abstract 51