Apparatus for detecting unknown malware using variable opcode sequence and method using the same

1. A method for detecting unknown malware, comprising:

collecting operation code (opcode) information from a detection target;

generating a multi-pixel image having a variable length by performing feature engineering on the opcode information; and

detecting unknown malware by inputting the multi-pixel image to a deep-learning model based on AI,

wherein the multi-pixel image corresponds to a multi-pixel RGB image based on an n-gram corresponding to the opcode information, and

wherein generating the multi-pixel image comprises:

storing n-gram sequences for hexadecimal (hex) codes having a variable length based on the opcode information; and

mapping a 3-gram of opcodes to an RGB code based on the n-gram sequences, thereby generating the multi-pixel RGB image.

2. The method of claim 1 , wherein collecting the opcode information comprises:

extracting a text section from an executable file corresponding to the detection target;

converting raw data in the text section to opcodes in an assembly language format using a binary analysis tool; and

extracting the hex codes based on the opcodes.

3. The method of claim 1 , wherein detecting the unknown malware is configured to detect the unknown malware in consideration of a similarity between feature information of each type of malware classified through training and multi-pixel feature information output from the deep-learning model.

4. The method of claim 1 , further comprising:

generating a multi-pixel image for training using opcode information collected based on multiple pieces of benign code and multiple pieces of malware and generating training data based on the multi-pixel image for training; and

training the deep-learning model using the training data.

5. The method of claim 4 , wherein training the deep-learning model is configured to acquire at least one of information about entropy of each piece of malware, an original creation date thereof, a final update date thereof, and information about a website via which the malware is distributed and to use the acquired information as the training data.

6. The method of claim 2 , wherein the opcode is a code for providing at least one function, among a logical operation, program flow control, memory manipulation, and an arithmetic operation.

7. The method of claim 2 , wherein the opcode corresponds to an opcode in the assembly language format in a one-to-one manner.

8. The method of claim 2 , wherein the opcode includes a 1-byte or 2-byte instruction and multiple operand values.

9. An apparatus for detecting unknown malware, comprising:

a processor for collecting operation code (opcode) information from a detection target, generating a multi-pixel image having a variable length by performing feature engineering on the opcode information, and detecting unknown malware by inputting the multi-pixel image to a deep-learning model based on AI; and

memory for storing the opcode information and the multi-pixel image,

wherein the multi-pixel image corresponds to a multi-pixel RGB image based on an n-gram corresponding to the opcode information, and

wherein the processor is configured to:

store n-gram sequences for hexadecimal (hex) codes having a variable length based on the opcode information; and

map a 3-gram of opcodes to an RGB code based on the n-gram sequences, thereby generating the multi-pixel RGB image.

10. The apparatus of claim 9 , wherein the processor is configured to:

extract a text section from an executable file corresponding to the detection target;

convert raw data in the text section to opcodes in an assembly language format using a binary analysis tool; and

extract the hex codes based on the opcodes.

11. The apparatus of claim 9 , wherein the processor is configured to detect the unknown malware in consideration of a similarity between feature information of each type of malware classified through training and multi-pixel feature information output from the deep-learning model.

12. The apparatus of claim 9 , wherein the processor is configured to:

generate a multi-pixel image for training using opcode information collected based on multiple pieces of benign code and multiple pieces of malware;

generate training data so as to correspond to the multi-pixel image for training; and

train the deep-learning model using the training data.

13. The apparatus of claim 12 , wherein the processor is configured to:

acquire at least one of information about entropy of each piece of malware, an original creation date thereof, a final update date thereof, and information about a website via which the malware is distributed, and

use the acquired information as the training data.

14. The apparatus of claim 10 , wherein the opcode is a code for providing at least one function, among a logical operation, program flow control, memory manipulation, and an arithmetic operation.

15. The apparatus of claim 10 , wherein the opcode corresponds to an opcode in the assembly language format in a one-to-one manner.

16. The apparatus of claim 10 , wherein the opcode includes a 1-byte or 2-byte instruction and multiple operand values.