Signal Processing - March 2016 - 110

Authors
Lakshmanan Nataraj (lakshmanan_nataraj@ece.ucsb.edu) received his Ph.D.
degree in electrical and computer engineering from the University of California,
Santa Barbara. His research interests
include malware analysis, image forensics,
and data hiding. He is currently a member
of research staff at Mayachitra, Inc.
B.S. Manjunath (manj@ece.ucsb.
edu) is a professor in the Department of
Electrical and Computer Engineering,
University of California, Santa Barbara.
His research interests include bioimaging,
informatics, media forensics and security,
steganography, large-scale image and video sensor networks, and multimedia databases. He is a Fellow of the IEEE.

100
RP + NN
GIST + NN
GIST + SRC
RP + SRC

Accuracy

95
90

RP+NN
GIST+NN
GIST+SRC
RP+SRC

85
80

0

50

100

150

200

250 300 350
Dimensions
(a)

400

450

500

550

100

Accuracy

95
90

RP + NN
GIST + NN
GIST + SRC
RP + SRC

85
80

0

50

100

150

200

250 300 350
Dimensions
(b)

400

450

References

500

[1] (2015, Dec.). Sony hack: Obama vows response as
FBI blames North Korea. [Online]. Available: http://
www.bbc.com/news/world-us-canada-30555997

550

figuRE 7. Experimental results on (a) Malimg data set and (b) Malheur data set with features using
RPs and GIST, and classification algorithms using SRC and NN.

The accuracies for GIST for both classifiers are almost the same. In [15], we
extend this approach using a simple
thresholding scheme to reject potential
outliers in a data set.

Future directions
While we explored signal- and imagebased analysis of malware data, a natural complement is to treat the malware
as audio-like 1-D signals and leverage
automated audio descriptors. Another
possible approach is computing image
similarity descriptors and/or random
projections on all the sections and represent a malware as a bag of descriptors, which can then be used for better
characterization of malware. Using the
error model in the sparse representation-based malware classification
framework, we can determine the exact
positions in which the malware variant
differs from another variant. This
approach can also be used to find the
exact source from which a malware variant evolves. Patched malware that
attaches to benign software can be identified using this method.
110

Conclusions
In this article, we explored orthogonal
methods to analyze malware motivated
by signal and image processing. Malware
samples are represented as images or signals. Image- and signal-based features are
extracted to characterize malware. Our
extensive experiments demonstrate the
efficacy of our methods on malware classification and retrieval. We believe that
our techniques will open the scope of signal- and image-based methods to broader
fields in computer security.

Acknowledgments
We would like to thank Prof. Giovanni
Vigna and Prof. Christopher Kruegel of
UCSB Seclab for providing the malware data and for their valuable suggestions. We are thankful to our
colleagues who worked in this project:
Dr. Gregoire Jacob, Dr. Dhilung Kirat
and Dr. S. Karthikeyan. We would also
like to thank Dr. Sukarno Mertoguno of
the Office of Naval Research (ONR) for
fruitful discussions. This work is supported by grants ONR N00014-11-10111 and
ONR N00014-14-1-0027.
IEEE Signal Processing Magazine

|

March 2016

|

[2] G. Jacob, P. M. Comparetti, M. Neugschwandtner,
C. Kruegel, and G. Vigna, "A static, packer-agnostic
filter to detect similar malware samples," in Proc. 9th
Int. Conf. Detection of Intrusions and Malware, and
Vulnerability Assessment, July 2012, pp. 102-122.
[3] A. Oliva and A. Torralba, "Modeling the shape of
the scene: A holistic representation of the spatial envelope," Int. J. Comput. Vision, vol. 42, no. 3,
pp. 145-175, May 2001.
[4] A. Torralba, K. P. Murphy, W. T. Freeman, and
M. Rubin, "Context-based vision system for place
and object recognition," in Proc. 9th IEEE Int. Conf.
Computer Vision, Oct. 2003, vol. 1, pp. 273-280.
[5] M. Douze, H. Jgou, H. Sandhawalia, L. Amsaleg,
and M. Schmid, "Evaluation of GIST descriptors for
Web-scale Image Search," in Proc. ACM Int. Conf.
Image and Video Retrieval, July 2009, no. 19, pp. 1-8.
[6] L. Nataraj, S. Karthikeyan, G. Jacob, and B. S.
Manjunath, "Malware images: Visualization and automatic classification," in Proc. 8th Int. Symp. Visualization for
Cyber Security, July 2011, no. 4, pp. 1-7.
[7] Y. Zhou and X. Jiang, "Dissecting Android malware:
Characterization and evolution," in Proc. IEEE Symp.
Security and Privacy, May 2012, no. 15, pp. 95-109.
[8] (2015, Dec.). Malimg Dataset. [Online].
Available: http://old.vision.ece.ucsb.edu/spam/
malimg.shtml
[9] K. Rieck, P. Trinius, C. Willems, and T. Holz,
"Automatic analysis of malware behavior using
machine learning," J. Comput. Security, vol. 19, no.
4, pp. 639-668, Dec. 2011.
[10] (2015, Dec.). VirusShare. [Online]. Available:
http://www.virusshare.com
[11] L. Nataraj, V. Yegneswaran, P. Porras, and J.
Zhang, "A comparative assessment of malware classification using binary texture analysis and dynamic
analysis," in Proc. 4th ACM Workshop on Security
and Artificial Intelligence, Oct. 2011, pp. 21-30.
[12] D. Kirat, L. Nataraj, G. Vigna, and B. S.
Manjunath, "SigMal: A static signal processing based
malware triage," in Proc. 29th Annu. Computer
Security Applications Conf., Dec. 2013, pp. 89-98.

(continued on page 117)
http://http:// http://www.bbc.com/news/world-us-canada-30555997 http://old.vision.ece.ucsb.edu/spam/ http://www.virusshare.com
Table of Contents for the Digital Edition of Signal Processing - March 2016
