Malware remains a primary threat in cybersecurity, used by cybercriminals to damage digital systems. In this work, we propose a novel malware classification pipeline that transforms raw executable files, even obfuscated ones, into structured data representations, namely graphs and grayscale images, suitable for deep learning models. Starting from real-world samples executed in a sandboxed environment, our method extracts opcodes from memory dumps and builds opcode transition graphs, which can be used directly or as the basis for image construction. With our prototype, we evaluate lightweight deep learning models on both representations, demonstrating that even with simple architectures and a limited dataset, our approach achieves promising results, particularly high precision, highlighting its potential for earlystage, automated malware triage.
Seeing Malware Differently: A Novel Signal-Based Graph and Image Approach to Detection / Bragaglia, R., Lazzeretti, R.. - (2025), pp. 7-12. (17th IEEE International Workshop on Information Forensics and Security, IEEE WIFS 2025 Perth, Australia ) [10.1109/wifs66636.2025.00010].
Seeing Malware Differently: A Novel Signal-Based Graph and Image Approach to Detection
Lazzeretti, Riccardo
2025
Abstract
Malware remains a primary threat in cybersecurity, used by cybercriminals to damage digital systems. In this work, we propose a novel malware classification pipeline that transforms raw executable files, even obfuscated ones, into structured data representations, namely graphs and grayscale images, suitable for deep learning models. Starting from real-world samples executed in a sandboxed environment, our method extracts opcodes from memory dumps and builds opcode transition graphs, which can be used directly or as the basis for image construction. With our prototype, we evaluate lightweight deep learning models on both representations, demonstrating that even with simple architectures and a limited dataset, our approach achieves promising results, particularly high precision, highlighting its potential for earlystage, automated malware triage.I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.


