Mem2Img: Memory-Resident Malware Detection via Convolution Neural Network
summary
Mem2Img converts process memory dumps into RGB images where the red channel is raw byte values, the green channel is local entropy and the blue channel is scaled short-window entropy, adds LBP textures, then extracts features with VGG16 InceptionV3 and a small CNN, reduces to ~1,000 dimensions with PCA and classifies with logistic regression. Evaluation on a 13‑class task with 12,569 memory blocks shows the CNN-only branch hits ~96% accuracy, grayscale alone 88% and LBP alone ~54%, ensemble performs best. It publishes code and discusses adversarial evasion like size inflation and code mixing.
AI-written summary · about
chapters (10)
- 0:00Introduction to the topic
- 1:36Memory injection techniques
- 6:36Dataset and methodology
- 9:30Framework design
- 14:01Feature extraction architecture
- 16:53Experimental results
- 19:23Clustering and zero-shot
- 20:17Saliency mapping analysis
- 22:53Zero-shot learning outcomes
- 24:41Adversarial attacks and wrap
related talks
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
14mim2im: Automatically Converting In-Memory Image Representations using A Knowledge(…)
34mNeural networks: insane in the membrane
22mSAD THUG...
45mVisual Regression Testing with Neural Networks
30mData Driven Security
32mDecoding Emotions from Art to Memes
31mGrokking LIME: How can we explain why an image classifier "knows" what’s in a photo...