Imbalanced Malware Family Classification Using Multimodal Fusion and Weight Self-Learning

In recent years, the increasing prevalence of Intelligent Transportation Systems with advanced technologies has led to the emergence of many targeted forms of malware such as ransomware, Trojans, viruses, and malicious mining programs. And malware authors use policies like category disguise or famil...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on intelligent transportation systems 2023-07, Vol.24 (7), p.7642-7652
Main Authors: Li, Shudong, Li, Yuan, Wu, Xiaobo, Otaibi, Sattam Al, Tian, Zhihong
Format: Article
Language:English
Subjects:
Classification
Codes
Computer viruses
Cybersecurity
Feature extraction
Histograms
imbalanced data
Intelligent transportation systems
Learning
Machine learning
Malware
Malware family classification
multimodal fusion
Ransomware
Semantics
Task analysis
weight self-learning
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In recent years, the increasing prevalence of Intelligent Transportation Systems with advanced technologies has led to the emergence of many targeted forms of malware such as ransomware, Trojans, viruses, and malicious mining programs. And malware authors use policies like category disguise or family obfuscation in malware components to evade detection, which poses a great security threat to enterprises, government agencies, and Internet users. In this paper, we propose a malware family classification approach based on multimodal fusion and weight self-learning. Firstly, multiple modalities of malware such as byte, format, statistic, and semantic are fused in various ways to generate effective features. And then, we creatively add a weight self-learning mechanism of malware families into the classification model, which works by continuously calculating log-loss based on the family label and the probabilities predicted by each feature. The approach proves to achieve excellent classification performance on highly imbalanced malware family datasets with high efficiency and small resource overhead, which helps to identify and classify malware families and enhance the efficiency of massive malware analysis in Intelligent Transportation Systems.
ISSN:1524-9050
1558-0016
DOI:10.1109/TITS.2022.3208891