Fig 1.
The overall framework for APT malware classification.
Fig 2.
Total number and distribution of APT samples dataset.
Table 1.
Public benchmark dataset D1.
Table 2.
Self-constructed APT samples dataset D2.
Fig 3.
Comparison of APT groups malicious code gray-scale images.
Fig 4.
Flowchart of image grayscale value feature acquisition.
Fig 5.
APT malicious code disassembly processing.
Fig 6.
Extraction of APT malicious code opcode instruction.
Fig 7.
N-gram feature extraction process.
Fig 8.
Data concatenation.
Fig 9.
TCN network architecture diagram based on feature fusion.
Fig 10.
Basic architecture of TCN model.
Fig 11.
Schematic diagram of causal convolution.
Fig 12.
Schematic diagram of expansion convolution.
Fig 13.
Structure diagram of BITCN network.
Fig 14.
Diagram of GAN.
Table 3.
Test platform parameters.
Table 4.
Classification results matrix.
Table 5.
Parameter settings.
Table 6.
Classification results of machine learning algorithms on N-gram features.
Fig 15.
Training accuracy curve of TCN with N-gram features.
Fig 16.
Training loss curve of TCN with N-gram features.
Table 7.
Classification results of deep learning algorithms on N-gram features.
Table 8.
Classification results of machine learning algorithms with image features.
Fig 17.
Training accuracy curve of 1D-CNN model with image features.
Fig 18.
Training loss curve of 1D-CNN model with image features.
Table 9.
Classification results of deep learning algorithms with image features.
Table 10.
Classification results of machine learning with N-gram and image dual features.
Fig 19.
Training accuracy curve of TCN with N-gram and image features.
Fig 20.
Training loss curve of TCN with N-gram and image features.
Fig 21.
Training accuracy curve of BITCN with N-gram and image features.
Fig 22.
Training loss curve of BITCN with N-gram and image features.
Table 11.
Classification results of deep learning with N-gram and image dual features.
Table 12.
Comparison of machine learning algorithm results for N-gram + grayscale value frequency features.
Fig 23.
Training accuracy curve of TCN Model with N-gram + grayscale value frequency features.
Fig 24.
Training loss curve of TCN model with N-gram + grayscale value frequency features.
Fig 25.
Training accuracy curve of BITCN model with N-gram + grayscale value frequency features.
Fig 26.
Training loss curve of BITCN model with N-gram + grayscale value frequency features.
Fig 27.
Confusion matrix of TCN model with N-gram + grayscale value frequency features.
Table 13.
Comparison of machine learning algorithm results for N-gram + grayscale value frequency features.
Fig 28.
Data distribution results for 12 categories.
Table 14.
Optimal stability parameters.
Table 15.
Classification results of machine learning algorithms on dataset D1 after expansion
Table 16.
Classification results of deep learning algorithms on dataset D1 after expansion.
Table 17.
Classification results of machine learning on dataset D2 after expansion.
Fig 29.
Training accuracy curve of the TCN model on dataset D2.
Fig 30.
Training loss curve of the TCN model on dataset D2.
Table 18.
Classification results of deep learning on dataset D2 after expansion.
Table 19.
Comprehensive performance comparison of machine learning algorithms for classification.
Table 20.
Comprehensive performance comparison of deep learning algorithms for classification.
Table 21.
Comparison with similar research literature.