Familial analysis of interface and program targeting noise contained malware using image processing

Malware variants are increasing at a rapid pace and their detection is becoming a cumbersome task. A lot of work detect malware using the behavioural signatures of the binary executables. Existing malware detectors are inefficient due to the noise that is embedded within the malware. The exact localization of the target of the malware is still in development. The recognition of the exact family of the malware is still improving, and it helps in improving the features required for their proper identification. In this paper, we execute the familial analysis of interface and program targeting noise contained malware using image processing. We use the system call dataset generated from NITRSCT (NITR System Call Tracer) and use cuckoo sandbox for generating API calls. Representation of the binary executables are in the form of grayscale image with noise within them. We apply image-processing technique to identify the target of the malware, i.e. interface or program. This is being done in the first phase of detection. After the target is identified, we send interface targeting malware to system callbased detector and program targeting to the API-based. The familial analysis is accomplished by both the detectors and exact family is identified. Upon extensive experiments, it is illustrated that our model can achieve higher accuracy, 99.4%, 77.9% target localization accuracy and 1.03s detection time. Our classification accuracy is 91.3%, which is far better than present state-of-the-art approaches.