使用混合RGB圖像擴增技術提升Android小樣本惡意家族分類能力;RGB-based Hybrid Augmentation for Android Minor Malware Family Classification

NCUIR > School of Management at National Central University > Graduate Institute of Information Management > Electronic Thesis & Dissertation > Item 987654321/89869

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/89869

Title:	使用混合RGB圖像擴增技術提升Android小樣本惡意家族分類能力;RGB-based Hybrid Augmentation for Android Minor Malware Family Classification
Authors:	丁翊軒;Ting, Yi-Hsuan
Contributors:	資訊管理學系
Keywords:	Android;惡意程式檢測;惡意家族分類;資料擴增;混合擴增;深度學習;Android;Malware detection;Malware family classification;Data augmentation;Hybrid augmentation;Deep learning
Date:	2022-07-29
Issue Date:	2022-10-04 12:03:06 (UTC+8)
Publisher:	國立中央大學
Abstract:	隨著電腦運算速度的提升，許多研究透過深度學習方法來進行Android惡意程式檢測，但是除了惡意程式的二元檢測外，惡意程式家族分類更能夠使惡意程式研究人員了解其惡意家族的行為進而優化檢測方式及預防其變體。然而新出現的惡意程式家族數量少，容易導致分類效果不理想，而基於生成對抗網路的方法來進行擴增雖然可以提升分類效果，但是少量的資料還是會導致生成對抗網路方法所生成出的樣本品質不穩定，進而使分類效果提升有限。因此，本研究提出一種混合擴增方法，首先將提取惡意程式特徵並轉換成RGB圖像，再將樣本數過少的家族先經過高斯雜訊擴增方法（Gaussian Noise），再結合對於圖像擴增有更好效果的深度捲積生成對抗網路（Deep Convolutional Generative Adversarial Network，DCGAN）來擴增少數樣本的惡意程式家族，最後輸入至CNN（Convolutional Neural Network）進行家族分類。實驗結果顯示，使用本研究所提出的混合擴增方法，相較於未擴增以及只使用深度捲積生成對抗網路進行擴增，其F1-Score分別提升7~34%以及2%~7%。;With the improvement of computer computing speed, many researches use deep learning for Android malware detection. In addition to malware detection, malware family classification will help malware researchers understand the behavior of the malware families to optimize detection and prevent variants. However, the new malware family has few samples, which lead to poor classification results. Although the deep learning augmentation method (GAN-based) can improve the classification results, but minor data will still lead to the unstable quality of the data generated by the deep learning augmentation method, which will limit the improvement of classification results. In this study, we will propose a hybrid augmentation method, first extracting malware features and converting them into RGB images, and then the minor families will augment by the gaussian noise augmentation method, and then combined with the deep convolutional generative adversarial network (DCGAN) which have better effect on image augmentation, and finally input to CNN for family classification. The experimental results show that using the hybrid augmentation method proposed in this study, compared to no augmentation and augmentation with only using the deep convolutional generative adversarial network, the F1-Score increased between 7%~34% and 2%~7%.
Appears in Collections:	[Graduate Institute of Information Management] Electronic Thesis & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	64	View/Open

社群 sharing

Loading...