Malware Classification using CNN: Static Detection

• I'm sharing with you in this repository usefull articles, codes and Steps used to classify 9 families of malware with 95% of accuracy. Our Goals in this project is to classify IoT malwares based on their families using CNN. You can increase the number of families if you have enough samples. We used Python for Coding.

• In Our Case The malwares are saved in one big repository. We Used Sanbox to analyse the malwares and saved the results in mongoDB.

• This is example of result return by Sandbox :

{"_id":{"$oid":"5df76f7ea5af05b44d00fa1e"},"avclass_family":"mirai","virustotal":true,"source":"VirusShare","added_date":{"$date":{"$numberLong":"1576497022160"}},"downloaded":true,"sha1":"29ddf187f7348860e1153f37df88c491af81c24b","ssdeep":"768:ooV301WYQFIhi8SkhzQf9uksxlC6BmagtO+TgDD1ELwSGc8:ob11YIo8SkhzKITx1ca84OL+","sha256":"da0d9a61126f52ff1aef28085237fdaa942612a91a53da98c7a636a8083dd8c4","type":"ELF","md5":"6fcf91dcb63755e4fcc4f8b61c76b040","lisa_submitted":true,"lisa_task_id":"f4cef0be-4a1c-458c-8c2e-0a9223540f22","avclass_family_verbose":"[('mirai', 15), ('gafgyt', 2)]\n","lisa_analysed":true,"lisa_status":"FAILURE","arch":"sparc","machine":"SUN SPARC"}
{"_id":{"$oid":"5df76f7ea5af05b44d00fa21"},"avclass_family":"mirai","virustotal":true,"source":"VirusShare","added_date":{"$date":{"$numberLong":"1576497022168"}},"downloaded":true,"sha1":"feda2c1985ec57e3b91c89764acc5859ab0a4102","ssdeep":"768:8et1QnQmyYvb26bB0ZiRfFlAPlLx2qCLqLsGM7CuNyTK53rY3HMt5AIs4spJpsEC:8DyCbB04aPBx1aGGzqK53rrTsnpq","sha256":"fdf9ec1888f324c9ad74ce35d7e0a63999a95dee602438c4eaa4d09e13d5e872","type":"ELF","md5":"8c79603da4dad6c5054ce9a940cba3b9","lisa_submitted":true,"lisa_task_id":"2ad27a24-0245-4bd5-8840-a6f67e6eeff9","avclass_family_verbose":"[('mirai', 23)]\n","lisa_analysed":true,"lisa_status":"FAILURE","arch":"ppc","machine":"PowerPC"}
{"_id":{"$oid":"5df76f7ea5af05b44d00fa24"},"avclass_family":"SINGLETON:34a404d6770ebed033b15906732cd086","virustotal":true,"source":"VirusShare","added_date":{"$date":{"$numberLong":"1576497022175"}},"downloaded":true,"sha1":"b55feba067f35e3dc433499b7c05071700f5a280","ssdeep":"384:8/fLVxpFKKKl0QYKO6cjwQMr6ud6Lv+NrM/69uKJ/V3vdfh1NRnmZq+E:ubeodhwyc9uKlZXRnH","sha256":"27c94473d40c1c1c9974053dc0753bdfa3500300fc34cbadb7f15a1a8de440f3","type":"ELF","md5":"34a404d6770ebed033b15906732cd086","lisa_submitted":true,"lisa_task_id":"126353f3-99d1-4210-9607-2609758b15b8","avclass_family_verbose":"[]\n","lisa_analysed":true,"lisa_status":"FAILURE"}

• You can read more about avclass family tool and how it works: https://github.com/malicialab/avclass

1- Search for samples in DB:

• First You need to search for Spesific Family and extract all names from DB into File, in our case the samples are named based on md5 hash.
• this command will extract the first 10000 sample hash of mirai malware family and saved them into a file.

mongo malwaredb --quiet --eval 'DBQuery.shellBatchSize = 10000; db.newcollection.find({avclass_family : {$in :[ "mirai","mirai\n"] } }, {md5:1, _id:0}).limit(10000).toArray()' > mirai_10000_sample.json

2- Labeling the malware families :

• The Samples are stored in a one mixed repository , so we used the file of hashes for a target family obtained from previous step to copy them into target folder.
• You should create the Mirai Folder manually in this case( Check Copy Binary Files codes).
• modify the code based on your folder and file names.

3- Converting Malware as Grayscale Images :

We used the method suggested by Natarj. you can find the article in the resources section. https://github.com/ncarkaci/binary-to-image

4- CNN Code

• We applied Xception Pre-trained Model in this python code where you can change the model to fit your own model.
• We Used K-fold Cross Validation to handle the problem of imbanced Dataset.
• You Need To create Train , test and Validation Folders manualy, then create each class of malware in the 3 folders. https://github.com/SadmanSakib93/Stratified-k-fold-cross-validation-Image-classification-keras

5- Upload and test your model:

After saving your model to disk, you can use the file test_your_model.ipynb after uploading the model from google drive then test it. The best way is using google colab, it is free and dynamic. You should also upload your data into google drive also.

6- Dataset

https://drive.google.com/drive/folders/1IYE32_fEw3KfRHDR6C26KDf-U4-z-xu4?usp=sharing

Free Malware Repositories

https://zeltser.com/malware-sample-sources/

Linux Malware Samples Repository :

https://github.com/MalwareSamples/Linux-Malware-Samples

Other Usefull Links:

https://github.com/cheejunwong/Malware-Classification-using-LSTM https://github.com/christianversloot/machine-learning-articles/blob/main/how-to-use-k-fold-cross-validation-with-keras.md https://medium.datadriveninvestor.com/what-convolutional-neural-network-architecture-works-best-for-classifying-malware-images-5a1215542f6a https://medium.com/@dipti.rohan.pawar/improving-performance-of-convolutional-neural-network-2ecfe0207de7 https://www.analyticsvidhya.com/blog/2021/09/how-to-apply-k-fold-averaging-on-deep-learning-classifier/?fbclid=IwAR1M9VzWQoJTIz2JJfDNP8L2-nczXE2hNDgV8yhYGuirJ1kmfmMv8kKJYy4 https://medium.com/the-owl/k-fold-cross-validation-in-keras-3ec4a3a00538 https://github.com/duj12/cnn-lstm-based-malware-document-classification