Image Recognition-based Deep Neural Network for Packed Malware Detection

While deep learning models are widely adopted in malware detection, ResNet has been proved to be the most effective model in many researches. However, most existing models, including ResNet, failed to detect packed malware with satisfactory accuracy. To solve this problem, a deep neural network framework by optimizing fragmented image and extracting key textual feature patterns is proposed for packed malware detection. Each malware image is fragmented into multiple slices for key feature points extraction with two feature point locating algorithms, including SIFT (Scale-Invariant Feature Transform) and ORB (Oriented FAST and Rotated BRIEF). By choosing those key feature points that are marked by both SIFT and ORB as input, the trained ResNet achieves high performance with 95.48% accuracy on average. Meanwhile, ResNet is capable of detecting and identifying packed malware within 1 minute on average.