PH-CNN for PE Malware Detection Using Enhanced Image

In the current malware family classification, gray images converted frombinary PE files are subject to code shelling, obfuscation, and other variant techniques, which undermine the similarity of malware images between same family. To solve this problem and improve detection efficiency, a method by enhancing the gray image and using PH-CNN as the detection model is proposed. First, the original image is enhanced by discarding the subjectively set machine code (DSMD) and adding section distribution information (ASDI), and then the enhanced imageis detected by PH-CNN model. Among them, the PH-CNN model consists of Perceptual Hashing detection module and CNN detection module. Malware images are first detected by Perceptual Hashing module to quickly divide the samples of specific malware families and uncertain malware families, and then, the samples of uncertain malware families are detected by the CNN detection module. The experimental results on Microsoft Malware Classification Challenge dataset show that compared with the original gray image, the detection accuracy using enhanced image is higher, reaching 98.68%. Meanwhile, compared with using only CNN module, the proposed detection model has higher detection efficiency and the detection speed is improved by 79%.