With the rapid development of automation tools including polymorphic and metamorphic engines, generic packers, and genetic programming, many variants of malware have emerged, which pose a significant threat to the Internet security. To effectively detect malware variants, researchers have developed visualization-based approaches that can visualize malware adaptations for in-depth malware analysis. However, most existing visualization approaches rely on the binary image of a malware sample, which fail to provide an effective texture feature representation and thus often result in low efficiency in coping with challenging malware samples. In this paper, we proposeSpecView, a malware spectrum visualization framework with singular spectrum transformation. SpecView converts malware binary code into one-dimensional time series spectrum data, and leverages the singular spectrum transformation method to obtain the structural changes preserved in the time series spectrum data. Then, we utilize the particle swarm optimization algorithm to optimize the singular spectrum transformation performance in SpecView. We apply SpecView in the task of malware classification. Extensive experimental results show that SpecView is effective and efficient in malware classification on the Malimg, Malheur, Drebin, and PRAGuard Malgenome Class Encryption datasets, with classification accuracy exceeding 99%, and it can effectively identify malware variants that use evasive techniques such as packer and encryption obfuscation. The proposed method outperforms the state-of-the-art methods on all datasets and the classification accuracy reaches 100% for 5 malware families packed by the UPX packer on the Malimg dataset, as well as 9 malware families that use Class Encryption obfuscation techniques on the PRAGuard Malgenome Class Encryption datasets.

Deconvolution is known as an ill-posed problem. In order to solve such a problem, a regularization method is needed to constrain the solution space and find a plausible and stable solution. In practice, it is very computation intensive when using cross-validation method to select the regularization parameter. In this paper, we present an adaptive regularization method to find the optimal regularization parameter value and represent the trade-off between model fitness of the data and the smoothness of the extracted signal. Spectral signal extraction experimental results demonstrate that the time complexity the proposed method is much lower than the one without adaptive regularization and is convenient for users also. And quantitative performance analysis show that the proposed intelligent approach performs better than that of current deconvolution extraction method and other extraction method used in the Large Area Multi-Objects Fiber Spectroscopy Telescope spectral signal processing pipeline.