Learning and Classification of Malware Behavior

  • Authors:

  • Konrad Rieck;Thorsten Holz;Carsten Willems;Patrick Düssel;Pavel Laskov

  • Affiliations:

  • Intelligent Data Analysis Department, Fraunhofer Institute FIRST, Berlin, Germany;Laboratory for Dependable Distributed Systems, University of Mannheim, Mannheim, Germany;Laboratory for Dependable Distributed Systems, University of Mannheim, Mannheim, Germany;Intelligent Data Analysis Department, Fraunhofer Institute FIRST, Berlin, Germany;Intelligent Data Analysis Department, Fraunhofer Institute FIRST, Berlin, Germany and Wilhelm-Schickard-Institute for Computer Science, University of Tübingen, Tübingen, Germany

  • Venue:
  • DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Malicious software in form of Internet worms, computer viruses, and Trojan horses poses a major threat to the security of networked systems. The diversity and amount of its variants severely undermine the effectiveness of classical signature-based detection. Yet variants of malware families share typical behavioral patternsreflecting its origin and purpose. We aim to exploit these shared patterns for classification of malware and propose a method for learning and discrimination of malware behavior. Our method proceeds in three stages: (a) behavior of collected malware is monitored in a sandbox environment, (b) based on a corpus of malware labeled by an anti-virus scanner a malware behavior classifieris trained using learning techniques and (c) discriminative features of the behavior models are ranked for explanation of classification decisions. Experiments with different heterogeneous test data collected over several months using honeypots demonstrate the effectiveness of our method, especially in detecting novelinstances of malware families previously not recognized by commercial anti-virus software.