Automatic code features extraction using bio-inspired algorithms

Abstract

The number of malicious applications that appear everyday has reached beyond any manual analysis. In the attempt to spread beyond personal computers, malware authors use new platforms like Android, iOS and .NET. The later has the advantage of being present on both desktop computers running Windows Vista or later and also on Windows Phone devices. Previous studies in the malware classification field have used the concept of OpCode $n$-grams. These are sequences of consecutive operation codes, that can be extracted from any type of application. In this paper we will show an improvement to this method, by eliminating some of the OpCodes, in order to get better classification results. The OpCodes selection is performed by two bio-inspired algorithms. First, a fitness function was designed, that measured how well we can detect some clusters of methods. Then, we encoded a possible solution as a chromosome in a Genetic Algorithm and as a particle, in Particle Swarm Optimization. Both methods found good OpCodes subsets that were successful in detecting clusters from the cross-validation tests. The results presented in this paper show that biology can be a source of inspiration not only for computer viruses but also for new methods to combat them.