关键词: 恶意软件检测, 深度学习, 恶意软件分类, 内存取证, 可视化

Abstract: Malware detection is becoming more and more challenging due to the increasing complexity and variability of malicious code. Most mutated or unknown malicious programs are formed by improving or obfuscating the logic of existing malicious codes, so it is becoming more and more important to discover malicious code families and determine their malicious behaviors. In this paper, we proposed a novel malware visualization method based on GHM (Gray, HOG, Markov) for data preprocessing. Unlike the traditional visualization methods, this method extracts more effective data features through HOG and Markov in the visualization process, and constructs a threechannel color image. In addition, a VLMal classification model based on CNN and LSTM is constructed to realize the malware detection and classification of visual images. Experimental results show that this method can effectively detect and classify malicious code with good accuracy and stability.

Key words: malware detection, deep learning, malware classification, memory forensics, visualization