Blake Anderson
ABSTRACT
Malware classification systems have typically used some machine learning algorithm in conjunction with either static or dynamic features collected from the binary. Recently, more advanced malware has introduced mechanisms to avoid detection in these views by using obfuscation techniques to avoid static detection and execution-stalling techniques to avoid dynamic detection. In this paper we construct a classification framework that is able to incorporate both static and dynamic views into a unified framework in the hopes that, while a malicious executable can disguise itself in some views, disguising itself in every view while maintaining malicious intent will prove to be substantially more difficult. Our method uses kernels to place a similarity metric on each distinct view and then employs multiple kernel learning to find a weighted combination of the data sources which yields the best classification accuracy in a support vector machine classifier. Our approach opens up new avenues of malware research which will allow the research community to elegantly look at multiple facets of malware simultaneously, and which can easily be extended to integrate any new data sources that may become popular in the future.
- Offensive Computing. http://www.offensivecomputing.net/, Accessed June 2011.Google Scholar
- Virus Total. http://www.virustotal.com/, Accessed October 2011.Google Scholar
- Portable Executable iDentifier. http://peid.info/, Accessed 6 October 2011.Google Scholar
- Blake Anderson, Daniel Quist, Joshua Neil, Curtis Storlie, and Terran Lane. Graph-Based Malware Detection using Dynamic Analysis. Journal in Computer Virology, 7:247--258, 2011. Google ScholarDigital Library
- Anubis. http://anubis.iseclab.org/, 2009.Google Scholar
- Francis R. Bach, Gert R. G. Lanckriet, and Michael I. Jordan. Multiple Kernel Learning, Conic Duality, and the SMO Algorithm. In Proceedings of the Twenty-First International Conference on Machine Learning. ACM, 2004. Google ScholarDigital Library
- Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt, and Andrew Warfield. Xen and the Art of Virtualization. In Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, pages 164--177. ACM, 2003. Google ScholarDigital Library
- Ulrich Bayer, Paolo Milani Comparetti, Clemens Hlauschek, Christopher Kruegel, and Engin Kirda. Scalable, Behavior-Based Malware Clustering. In ISOC Network and Distributed System Security Symposium. 2009.Google Scholar
- Ulrich Bayer, Andreas Moser, Christopher Kruegel, and Engin Kirda. Dynamic Analysis of Malicious Code. Journal in Computer Virology, 2:67--77, 2006.Google ScholarCross Ref
- Daniel Bilar. Opcodes as Predictor for Malware. International Journal of Electronic Security and Digital Forensics, 1:156--168, January 2007. Google ScholarDigital Library
- Christopher M. Bishop. Pattern Recognition and Machine Learning (Information Science and Statistics). Springer-Verlag New York, Inc., Secaucus, NJ, USA, 2006. Google ScholarDigital Library
- Christopher J. C. Burges. A Tutorial on Support Vector Machines for Pattern Recognition. Data Mining and Knowledge Discovery, 2:121--167, 1998. Google ScholarDigital Library
- Mihai Christodorescu and Somesh Jha. Static Analysis of Executables to Detect Malicious Patterns. In Proceedings of the 12th USENIX Security Symposium, pages 169--186, 2003. Google ScholarDigital Library
- Jianyong Dai, Ratan Guha, and Joohan Lee. Efficient Virus Detection Using Dynamic Instruction Sequences. Journal of Computers, 4(5), 2009.Google ScholarCross Ref
- Artem Dinaburg, Paul Royal, Monirul Sharif, and Wenke Lee. Ether: Malware Analysis Via Hardware Virtualization Extensions. In Proceedings of the 15th ACM Conference on Computer and Communications Security, pages 51--62, 2008. Google ScholarDigital Library
- J. A. Hartigan and M. A. Wong. Algorithm AS 136: A K-Means Clustering Algorithm. Journal of the Royal Statistical Society. Series C (Applied Statistics), 28(1):100--108, 1979.Google Scholar
- R. Hettich and K. O. Kortanek. Semi-Infinite Programming: Theory, Methods, and Applications. SIAM Review, 35:380--429, September 1993. Google ScholarDigital Library
- Steven A. Hofmeyr, Stephanie Forrest, and Anil Somayaji. Intrusion Detection Using Sequences of System Calls. Journal of Computer Security, 6(3):151--180, January 1998. Google ScholarCross Ref
- Md. Karim, Andrew Walenstein, Arun Lakhotia, and Laxmi Parida. Malware Phylogeny Generation Using Permutations of Code. Journal in Computer Virology, 1:13--23, 2005.Google ScholarCross Ref
- H. Kashima, K. Tsuda, and A. Inokuchi. Kernels for Graphs. MIT Press, 2004.Google Scholar
- J. Zico Kolter and Marcus A. Maloof. Learning to Detect and Classify Malicious Executables in the Wild. The Journal of Machine Learning Research, 7:2721--2744, December 2006. Google ScholarDigital Library
- Christopher Kruegel, Engin Kirda, Darren Mutz, William Robertson, and Giovanni Vigna. Polymorphic Worm Detection Using Structural Information of Executables. In Recent Advances in Intrusion Detection, pages 207--226. Springer Berlin / Heidelberg, 2006. Google ScholarDigital Library
- G. Jacob L. Nataraj, S. Karthikeyan and B. Manjunath. Malware Images: Visualization and Automatic Classification. In Proceedings of VizSec, 2011. Google ScholarDigital Library
- Corrado Leita, Ulrich Bayer, and Engin Kirda. Exploiting Diverse Observation Perspectives to get Insights on the Malware Landscape. In 2010 IEEE/IFIP International Conference on Dependable Systems and Networks, pages 393--402, 2010.Google ScholarCross Ref
- Chi-Keung Luk, Robert Cohn, Robert Muth, Harish Patil, Artur Klauser, Geoff Lowney, Steven Wallace, Vijay Janapa Reddi, and Kim Hazelwood. Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. ACM SIGPLAN Conference on Programming Language Design and Implementation, pages 190--200, June 2005. Google ScholarDigital Library
- Ulrike Luxburg. A Tutorial on Spectral Clustering. Statistics and Computing, 17(4):395--416, 2007. Google ScholarDigital Library
- Robert Lyda and James Hamrock. Using Entropy Analysis to Find Encrypted and Packed Malware. IEEE Security & Privacy, 5(2):40--45, 2007. Google ScholarDigital Library
- Eitan Menahem, Asaf Shabtai, Lior Rokach, and Yuval Elovici. Improving Malware Detection by Applying Multi-Inducer Ensemble. Computational Statistics and Data Analysis, 53(4):1483--1494, 2009. Google ScholarDigital Library
- Andreas Moser, Christopher Kruegel, and Engin Kirda. Limits of Static Analysis for Malware Detection. Computer Security Applications Conference, Annual, 0:421--430, 2007.Google Scholar
- Jon Oberheide, Evan Cooke, and Farnam Jahanian. CloudAV: N-version Antivirus in the Network Cloud. In Proceedings of the 17th Conference on Security Symposium, pages 91--106, 2008. Google ScholarDigital Library
- Jon Oberheide, Kaushik Veeraraghavan, Evan Cooke, Jason Flinn, and Farnam Jahanian. Virtualized In-Cloud Security Services for Mobile Devices. In Proceedings of the First Workshop on Virtualization in Mobile Computing, MobiVirt, pages 31--35. ACM, 2008. Google ScholarDigital Library
- Roberto Perdisci, David Dagon, Prahlad Fogla, and Monirul Sharif. Misleading Worm Signature Generators Using Deliberate Noise Injection. In In Proceedings of the 2006 IEEE Symposium on Security and Privacy, pages 17--31, 2006. Google ScholarDigital Library
- IDA Pro. http://www.hex-rays.com/products/ida/index.shtml, 2012.Google Scholar
- Daniel Quist, Lorie Liebrock, and Joshua Neil. Improving Antivirus Accuracy with Hypervisor Assisted Analysis. Journal in Computer Virology, pages 1--11, 2010. Google ScholarDigital Library
- Konrad Rieck, Thorsten Holz, Carsten Willems, Patrick Düssel, and Pavel Laskov. Learning and Classification of Malware Behavior. In Detection of Intrusions and Malware, and Vulnerability Assessment, volume 5137 of Lecture Notes in Computer Science, pages 108--125. Springer Berlin / Heidelberg, 2008. Google ScholarDigital Library
- Paul Royal, Mitch Halpin, David Dagon, Robert Edmonds, and Wenke Lee. PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware. In 22nd Annual Computer Security Applications Conference (ACSAC), pages 289--300, 2006. Google ScholarDigital Library
- Bernhard Schölkopf and Alexander Johannes Smola. Learning with Kernels. MIT Press, 2002.Google Scholar
- R. Sekar, M. Bendre, D. Dhurjati, and P. Bollineni. A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors. In IEEE Symposium on Security and Privacy, pages 144--155, 2001. Google ScholarDigital Library
- M. Shafiq, Syed Khayam, and Muddassar Farooq. Embedded Malware Detection Using Markov n-Grams. In Detection of Intrusions and Malware, and Vulnerability Assessment, volume 5137 of Lecture Notes in Computer Science, pages 88--107. Springer Berlin / Heidelberg, 2008. Google ScholarDigital Library
- Madhu Shankarapani, Subbu Ramamoorthy, Ram Movva, and Srinivas Mukkamala. Malware Detection Using Assembly and API Call Sequences. Journal in Computer Virology, 7(2):1--13, 2010. Google ScholarDigital Library
- Nino Shervashidze, S. V. N. Vishwanathan, Tobias H. Petri, Kurt Mehlhorn, and Karsten M. Borgwardt. Efficient Graphlet Kernels for Large Graph Comparison. In Proceedings of the Twelfth International Conference on Artificial Intelligence and Statistics (AISTATS), volume 5, pages 488--495. CSAIL, 2009.Google Scholar
- Dawn Song, David Brumley, Heng Yin, Juan Caballero, Ivan Jager, Min Kang, Zhenkai Liang, James Newsome, Pongsin Poosankam, and Prateek Saxena. BitBlaze: A New Approach to Computer Security via Binary Analysis. In Information Systems Security, volume 5352 of Lecture Notes in Computer Science, pages 1--25. Springer Berlin / Heidelberg, 2008. Google ScholarDigital Library
- Sören Sonnenburg, Gunnar Rätsch, and Christin Schaefer. A General and Efficient Multiple Kernel Learning Algorithm. Nineteenth Annual Conference on Neural Information Processing Systems, 2005.Google Scholar
- Sören Sonnenburg, Gunnar Rätsch, Sebastian Henschel, Christian Widmer, Jonas Behr, Alexander Zien, Fabio de Bona, Alexander Binder, Christian Gehl, and Vojtvech Franc. The SHOGUN Machine Learning Toolbox. The Journal of Machine Learning Research, 99:1799--1802, August 2010. Google ScholarDigital Library
- Salvatore Stolfo, Ke Wang, and Wei-Jen Li. Towards Stealthy Malware Detection. In Malware Detection, volume 27 of Advances in Information Security, pages 231--249. Springer US, 2007.Google ScholarCross Ref
- Salvatore J. Stolfo, Ke Wang, and Wei-Jen Li. Fileprint Analysis for Malware Detection. In ACM Workshop on Recurring/Rapid Malcode, 2005.Google Scholar
- Symantec. Internet Security Threat Report, Volume 16. White Paper, April 2011.Google Scholar
- The Silicon Realms Toolworks. Armadillo Software Protection System. http://www.siliconrealms.com/, Accessed 6 October 2011.Google Scholar
- UPX: The Ultimate Packer for eXecutables. http://upx.sourceforge.net/, Accessed 6 October 2011.Google Scholar
- Yanfang Ye, Tao Li, Shenghuo Zhu, Weiwei Zhuang, Egmen Tas, Umesh Gupta, and Melih Abdulhayoglu. Combining File Content and File Relations for Cloud Based Malware Detection. In Proceedings of the 17th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2011. Google ScholarDigital Library
- Heng Yin, Dawn Song, Manuel Egele, Christopher Kruegel, and Engin Kirda. Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis. In Proceedings of the 14th ACM Conference on Computer and Communications Security, CCS '07, pages 116--127. ACM, 2007. Google ScholarDigital Library
Index Terms
- Improving malware classification: bridging the static/dynamic gap
Recommendations
Ontology for Malware Behavior: A Core Model Proposal
WETICE '14: Proceedings of the 2014 IEEE 23rd International WETICE ConferenceThe ubiquity of Internet-connected devices motivates attackers to create malicious programs (malware) to exploit users and their systems. Malware detection requires a deep understanding of their possible behaviors, one that is detailed enough to tell ...
Opcode sequences as representation of executables for data-mining-based unknown malware detection
Malware can be defined as any type of malicious code that has the potential to harm a computer or network. The volume of malware is growing faster every year and poses a serious global security threat. Consequently, malware detection has become a ...
Obfuscation: The Hidden Malware
A cyberwar exists between malware writers and antimalware researchers. At this war's heart rages a weapons race that originated in the 80s with the first computer virus. Obfuscation is one of the latest strategies to camouflage the telltale signs of ...
Comments