{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,11]],"date-time":"2025-12-11T21:00:38Z","timestamp":1765486838759,"version":"build-2065373602"},"reference-count":42,"publisher":"MDPI AG","issue":"22","license":[{"start":{"date-parts":[[2022,11,12]],"date-time":"2022-11-12T00:00:00Z","timestamp":1668211200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key Research and Development Program","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"China Academy of Military Sciences Fund","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"Liaoning Distinguished Professor Project","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"National Natural Science Foundation of China\u2013Guangdong Joint Fund","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"Jiangsu Key Research and Development Program","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"Project of Shenzhen Science and Technology Innovation Committee","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"National Science and Technology Major Project","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]},{"name":"project of Fujian University of Technology","award":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"],"award-info":[{"award-number":["017YFE0125300","017YFE0125300","017YFE0125300","U1801264","BE2019648","JCYJ20190809145407809","2017-V- 0011-0062","GY-Z19066"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>It is critical to detect malicious code for the security of the Internet of Things (IoT). Therefore, this work proposes a malicious code detection algorithm based on the novel feature fusion\u2013malware image convolutional neural network (FF-MICNN). This method combines a feature fusion algorithm with deep learning. First, the malicious code is transformed into grayscale image features by image technology, after which the opcode sequence features of the malicious code are extracted by the n-gram technique, and the global and local features are fused by feature fusion technology. The fused features are input into FF-MICNN for training, and an appropriate classifier is selected for detection. The results of experiments show that the proposed algorithm exhibits improvements in its detection speed, the comprehensiveness of features, and accuracy as compared with other algorithms. The accuracy rate of the proposed algorithm is also 0.2% better than that of a detection algorithm based on a single feature.<\/jats:p>","DOI":"10.3390\/s22228739","type":"journal-article","created":{"date-parts":[[2022,11,14]],"date-time":"2022-11-14T04:30:52Z","timestamp":1668400252000},"page":"8739","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["A Malicious Code Detection Method Based on FF-MICNN in the Internet of Things"],"prefix":"10.3390","volume":"22","author":[{"given":"Wenbo","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Information Science and Engineering, Shenyang Ligong University, Shenyang 110159, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yongxin","family":"Feng","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Shenyang Ligong University, Shenyang 110159, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6921-7369","authenticated-orcid":false,"given":"Guangjie","family":"Han","sequence":"additional","affiliation":[{"name":"Department of Information and Communication Systems, Hohai University, Changzhou 213022, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hongbo","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Shenyang Ligong University, Shenyang 110159, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaobo","family":"Tan","sequence":"additional","affiliation":[{"name":"School of Information Science and Engineering, Shenyang Ligong University, Shenyang 110159, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,11,12]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.cose.2022.102761","article-title":"Feature fusion-based malicious code detection with dual attention mechanism and BiLSTM","volume":"119","author":"Shen","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_2","unstructured":"Trivikram, M., and Nir, N. (Neural Netw., 2022). Improving malicious email detection through novel designated deep-learning architectures utilizing entire email, Neural Netw., in press."},{"key":"ref_3","first-page":"1","article-title":"Malicious code classification based on opcode sequences and textCNN network","volume":"67","author":"Wang","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"72","DOI":"10.1016\/j.jpdc.2022.06.004","article-title":"A novel flow-vector generation approach for malicious traffic detection","volume":"169","author":"Hou","year":"2022","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_5","unstructured":"Malka, N. (Comput. Netw., 2022). Estimation of the success probability of a malicious attacker on blockchain-based edge network, Comput. Netw., in press."},{"key":"ref_6","first-page":"103123","article-title":"Image-based malicious Internet content filtering method for child protection","volume":"65","author":"RAsim","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_7","first-page":"745","article-title":"Predicting stock market returns from malicious attacks: A comparative analysis of vector autoregression and time-delayed neural networks","volume":"51","author":"Lara","year":"2022","journal-title":"Decis. Support Syst."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"117083","DOI":"10.1016\/j.eswa.2022.117083","article-title":"HEAVEN: A Hardware-Enhanced AntiVirus ENgine to accelerate real-time, signature-based malware detection","volume":"201","author":"Marcus","year":"2022","journal-title":"Expert Syst. Appl."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"109375","DOI":"10.1016\/j.asoc.2022.109375","article-title":"Intrusion detection technique based on flow aggregation and latent semantic analysis","volume":"127","author":"Wu","year":"2022","journal-title":"Appl. Soft Comput."},{"key":"ref_10","unstructured":"Zhu, J., Wu, Z., and Guan, Z. (2016, January 21). API Sequences Based Malware Detection for Android. Proceedings of the Ubiquitous Intelligence & Computing & IEEE Intl Conf on Autonomic & Trusted Computing & IEEE Intl Conf on Scalable Computing & Communications & Its Associated Workshops, Beijing, China."},{"key":"ref_11","unstructured":"Zhang, F., and Zhao, T. (2017, January 21\u201324). Malware Detection and Classification Based on N-Grams Attribute Similarity. Proceedings of the 2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC), Guangzhou, China."},{"key":"ref_12","unstructured":"Abhijit, Y., and Maninder, S. (February, January 31). Malware detection based on opcode frequency. Proceedings of the 2016 International Conference on Advanced Communication Control and Computing Technologies (ICACCCT), Pyeongchang, South Korea."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"231","DOI":"10.22619\/IJCSA.2016.100111","article-title":"N-gram Opcode Analysis for Android Malware Detection","volume":"1","author":"Kang","year":"2016","journal-title":"Int. J. Cyber Situat. Aware."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Imran, M., Afzal, M.T., and Qadir, M.A. (2015, January 29\u201331). Similarity-Based Malware Classification Using Hidden Markov Model. Proceedings of the 2015 Fourth International Conference on Cyber Security, Cyber Warfare, and Digital Forensic (CyberSec), Jakarta, Indonesia.","DOI":"10.1109\/CyberSec.2015.33"},{"key":"ref_15","first-page":"48","article-title":"Detecting Internet Worms Using Data Mining Techniques","volume":"6","author":"Siddiquiet","year":"2008","journal-title":"J. Syst. Cybern. Inform."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Moser, A., Kruegel, C., and Kirda, E. (2007, January 10\u201314). Limits of Static Analysis for Malware Detection. Proceedings of the Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), Miami Beach, FL, USA.","DOI":"10.1109\/ACSAC.2007.21"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1007\/s11416-015-0244-0","article-title":"Behavior-based features model for malware detection","volume":"12","author":"Hisham","year":"2016","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"ref_18","first-page":"266","article-title":"A Feature Selection and Modelling Method for Malicious Code","volume":"32","author":"Li","year":"2015","journal-title":"Comput. Appl. Softw."},{"key":"ref_19","first-page":"131","article-title":"MACSPMD: Malicious Code Detection Based on Malicious API Call Sequence Pattern Mining","volume":"45","author":"Rong","year":"2018","journal-title":"Comput. Sci."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1016\/j.cose.2018.11.001","article-title":"Survey of machine learning techniques for malware analysis","volume":"81","author":"Ucci","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_21","unstructured":"Davuluru, V.S.P., Narayanan, B.N., and Balster, E.J. (2019, January 15\u201319). Convolutional Neural Networks as Classification Tools and Feature Extractors for Distinguishing Malware Programs. Proceedings of the 2019 IEEE National Aerospace and Electronics Conference (NAECON), Dayton, OH, USA."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"251","DOI":"10.1016\/j.cose.2015.04.001","article-title":"AMAL: High-fidelity, behavior-based automated malware analysis and classification","volume":"52","author":"Mohaisen","year":"2015","journal-title":"Comput. Secur."},{"key":"ref_23","first-page":"9","article-title":"Malware visualization and automatic classification with enhanced information density","volume":"59","author":"Liu","year":"2019","journal-title":"J. Tsinghua Univ."},{"key":"ref_24","first-page":"66","article-title":"An Improved Semi-supervised Feature Selection Algorithm Based on Information Entropy","volume":"17","author":"Wan","year":"2021","journal-title":"Stat. Decis."},{"key":"ref_25","first-page":"125","article-title":"Research on Malicious Code Variant Detection Method Based on Texture Fingerprint","volume":"35","author":"Han","year":"2014","journal-title":"J. Commun."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1007\/s11416-018-0314-1","article-title":"Visual malware detection using local malicious pattern","volume":"15","author":"Hashem","year":"2019","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Xiao, G., Li, J., Chen, Y., and Li, K. (2020). MalFCS: An effective malware classification framework with automated feature extraction based on deep convolutional neural networks. J. Parallel Distrib. Comput., 141.","DOI":"10.1016\/j.jpdc.2020.03.012"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"154","DOI":"10.1049\/cje.2019.11.005","article-title":"Visualization Feature and CNN Based Homology Classification of Malicious Code","volume":"29","author":"Chu","year":"2020","journal-title":"Chin. J. Electron."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1016\/j.neunet.2014.09.003","article-title":"Deep learning in neural networks: An overview","volume":"61","author":"Schmidhuber","year":"2015","journal-title":"Neural Netw."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"Lecun","year":"2015","journal-title":"Nature"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Ke, J., Lin, R., and Sharma, A. (2021). An Automatic Instrument Recognition Approach Based on Deep Convolutional Neural Network. Recent Adv. Electr. Electron. Eng., 14\u201316.","DOI":"10.2174\/2352096514666210322155008"},{"key":"ref_32","first-page":"93","article-title":"Research on malicious code detection method based on deep belief network","volume":"29","author":"Qiang","year":"2019","journal-title":"Comput. Technol. Dev."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"64411","DOI":"10.1109\/ACCESS.2019.2916886","article-title":"A Multimodal Malware Detection Technique for Android IoT Devices Using Various Features","volume":"7","author":"Kumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"10012","DOI":"10.1016\/j.neucom.2020.02.105","article-title":"Learning selection channels for image steganalysis in spatial domain","volume":"401","author":"Ren","year":"2020","journal-title":"Neurocomputing"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Chechlinski, U., Siemitkowska, B., and Majewski, M. (2019). A System for Weeds and Crops Identification-Reaching over 10 FPS on Raspberry Pi with the Usage of MobileNets, DenseNet and Custom Modifications. Sensors, 19.","DOI":"10.20944\/preprints201907.0115.v1"},{"key":"ref_36","first-page":"210","article-title":"Parallel-CNN Network for Malware Detection","volume":"14","author":"Hamzeh","year":"2019","journal-title":"IET Inf. Secur."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"15","DOI":"10.1007\/s11416-018-0323-0","article-title":"Using convolutional neural networks for classification of malware represented as images","volume":"15","author":"Gibert","year":"2019","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"3187","DOI":"10.1109\/TII.2018.2822680","article-title":"Detection of Malicious Code Variants Based on Deep Learning","volume":"14","author":"Cui","year":"2018","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_39","first-page":"2333","article-title":"Malicious Code Classification Algorithm Based on Multi-feature Fusion","volume":"39","author":"Lang","year":"2019","journal-title":"J. Comput. Appl."},{"key":"ref_40","first-page":"97","article-title":"Malware Detection Based on Opcode Sequence Frequency Vector and Behavior Feature Vector","volume":"9","author":"Xiu","year":"2016","journal-title":"Inf. Secur. Commun. Priv."},{"key":"ref_41","first-page":"328","article-title":"Malicious Code Detection Based on Multi-feature Random Forest","volume":"37","author":"Li","year":"2020","journal-title":"Comput. Appl. Softw."},{"key":"ref_42","unstructured":"Luo, S. (2018). Research on Deep Learning Malicious Code Analysis and Detection Technology. [Ph.D. Thesis, Xinjiang University]."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/22\/8739\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:16:58Z","timestamp":1760145418000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/22\/8739"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,11,12]]},"references-count":42,"journal-issue":{"issue":"22","published-online":{"date-parts":[[2022,11]]}},"alternative-id":["s22228739"],"URL":"https:\/\/doi.org\/10.3390\/s22228739","relation":{},"ISSN":["1424-8220"],"issn-type":[{"type":"electronic","value":"1424-8220"}],"subject":[],"published":{"date-parts":[[2022,11,12]]}}}