Malware classification plays an important role in tracing attack sources of computer security. However, the existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with Spatial Pyramid Pooling was used to analyze grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis, not only accelerated the static analysis process by taking advantage of CNN in image recognition, but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static & dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174,607 malware samples from 63 malware families. The result showed Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

Transfer learning can enhance classification performance of a target domain with insufficient training data by utilizing knowledge relating to the target domain from source domain. Nowadays, it is common to see two or more source domains available for knowledge transfer, which can improve performance of learning tasks in the target domain. However, the classification performance of the target domain decreases due to mismatching of probability distribution. Recent studies have shown that deep learning can build deep structures by extracting more effective features to resist the mismatching. In this paper, we propose a new multi-source deep transfer neural network algorithm, MultiDTNN, based on convolutional neural network and multi-source transfer learning. In MultiDTNN, joint probability distribution adaptation (JPDA) is used for reducing the mismatching between source and target domains to enhance features transferability of the source domain in deep neural networks. Then, the convolutional neural network is trained by utilizing the datasets of each source and target domain to obtain a set of classifiers. Finally, the designed selection strategy selects classifier with the smallest classification error on the target domain from the set to assemble the MultiDTNN framework. The effectiveness of the proposed MultiDTNN is verified by comparing it with other state-of-the-art deep transfer learning on three datasets.

To give full play to the high efficiency and parallelism of multi-processor systems, the fireworks algorithm (FWA) is improved, and a multi-processor task scheduling algorithm based on improved FWA, named IMFWA, is proposed. IMFWA maps continuous space to discrete space by designing the fireworks location coding method, improves the Gaussian mutation process, and sets adaptive dimensions to accelerate the convergence speed of the algorithm. At the same time, in order to reduce the time complexity of the algorithm and shorten the time finding the optimal task scheduling sequence, the fitness-based tournament selection strategy is used instead of the rule based on Euclidean distance. Finally, IMFWA is compared with the basic fireworks algorithm and the genetic algorithms on the Matlab platform for performance analysis. The results show that the IMFWA has advantages in the convergence speed, and the negative impact of the number of tasks is also lower than the fireworks algorithm and genetic algorithm.