Today, malware is one of the primary cyberthreats to organizations. Malware has pervaded almost every type of computing device including the ones having limited memory, battery and computation power such as mobile phones, tablets and embedded devices like Internet-of-Things (IoT) devices. Consequently, the privacy and security of the malware infected systems and devices have been heavily jeopardized. In recent years, researchers have leveraged machine learning based strategies for malware detection and classification. Malware analysis approaches can only be employed in resource constrained environments if the methods are lightweight in nature. In this paper, we present MALITE, a lightweight malware analysis system, that can classify various malware families and distinguish between benign and malicious binaries. MALITE converts a binary into a gray scale or an RGB image and employs low memory and battery power consuming as well as computationally inexpensive malware analysis strategies. We have designed MALITE-MN, a lightweight neural network based architecture and MALITE-HRF, an ultra lightweight random forest based method that uses histogram features extracted by a sliding window. We evaluate the performance of both on six publicly available datasets (Malimg, Microsoft BIG, Dumpware10, MOTIF, Drebin and CICAndMal2017), and compare them to four state-of-the-art malware classification techniques. The results show that MALITE-MN and MALITE-HRF not only accurately identify and classify malware but also respectively consume several orders of magnitude lower resources (in terms of both memory as well as computation capabilities), making them much more suitable for resource constrained environments.

翻译：当前，恶意软件已成为组织面临的主要网络威胁之一。恶意软件几乎渗透到所有类型的计算设备中，包括内存、电池和计算能力有限的设备，如手机、平板电脑以及物联网等嵌入式设备。因此，受恶意软件感染的系统与设备的隐私和安全已受到严重威胁。近年来，研究者们采用基于机器学习的策略进行恶意软件检测与分类。只有在方法具有轻量级特性的情况下，恶意软件分析方法才能应用于资源受限环境。本文提出MALITE——一种轻量级恶意软件分析系统，它能够对多种恶意软件家族进行分类，并区分良性与恶意二进制文件。MALITE将二进制文件转换为灰度图或RGB图像，并采用低内存、低电池消耗且计算成本低廉的恶意软件分析策略。我们设计了基于轻量级神经网络的MALITE-MN架构，以及基于滑动窗口直方图特征的超轻量级随机森林方法MALITE-HRF。我们在六个公开数据集（Malimg、Microsoft BIG、Dumpware10、MOTIF、Drebin和CICAndMal2017）上评估两者的性能，并将其与四种最先进的恶意软件分类技术进行对比。结果表明，MALITE-MN和MALITE-HRF不仅能够准确识别和分类恶意软件，而且在内存和计算能力方面的资源消耗分别降低了数个数量级，使其更适合资源受限环境。