Image representation and deep inception-attention for file-type and malware classification

• Main Authors: Wang, Yi, Wu, Kejun, Liu, Wenyang, Yap, Kim-Hui, Chau, Lap-Pui
• Other Authors: School of Electrical and Electronic Engineering
• Format: Conference or Workshop Item
• Language: English
• Published: 2024
• Subjects: Computer and Information Science; Image representation; Self-attention; Memory forensics; File-type classification; Malware analysis
• Online Access: https://hdl.handle.net/10356/174535
• Institution: Nanyang Technological University

File-type classification aims to recognize the file types of files/fragments without file-system metadata, which is essential for memory forensics and data recovery. In this paper, we introduce an image representation and deep inception-attention manner for file-type classification. Specifically, we consider file-type classification as an image classification problem. Raw data sequences in the memory block are converted to 2D binary images, enriching the representation ability and visualization while retaining the completeness of the bitstream. With binary images as inputs, we propose a deep inception-attention network to extract discriminate horizontal features and re-calibrate the weights of feature maps, and finally, predict file types. Experiments on a large-scale benchmark show the superiority of the proposed model. Moreover, our method can be extended to a similar application, like malware classification, and achieve outstanding performance.