Improving malware classification: bridging the static/dynamic gap

Authors:
Blake Anderson;Curtis Storlie;Terran Lane
Affiliations:
Los Alamos National Laboratory, Los Alamos, NM, USA;Los Alamos National Laboratory, Los Alamos, NM, USA;University of New Mexico, Albuquerque, NM, USA
Venue:
Proceedings of the 5th ACM workshop on Security and artificial intelligence
Year:
2012

Citing 30
Cited 3

Semi-infinite programming: theory, methods, and applications

SIAM Review
A Tutorial on Support Vector Machines for Pattern Recognition

Data Mining and Knowledge Discovery
A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors

SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Xen and the art of virtualization

SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Multiple kernel learning, conic duality, and the SMO algorithm

ICML '04 Proceedings of the twenty-first international conference on Machine learning
Pin: building customized program analysis tools with dynamic instrumentation

Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation
MisleadingWorm Signature Generators Using Deliberate Noise Injection

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Pattern Recognition and Machine Learning (Information Science and Statistics)

Pattern Recognition and Machine Learning (Information Science and Statistics)
PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware

ACSAC '06 Proceedings of the 22nd Annual Computer Security Applications Conference
Learning to Detect and Classify Malicious Executables in the Wild

The Journal of Machine Learning Research
Static analysis of executables to detect malicious patterns

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Using Entropy Analysis to Find Encrypted and Packed Malware

IEEE Security and Privacy
A tutorial on spectral clustering

Statistics and Computing
Intrusion detection using sequences of system calls

Journal of Computer Security
Panorama: capturing system-wide information flow for malware detection and analysis

Proceedings of the 14th ACM conference on Computer and communications security
Opcodes as predictor for malware

International Journal of Electronic Security and Digital Forensics
Embedded Malware Detection Using Markov n-Grams

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Learning and Classification of Malware Behavior

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Ether: malware analysis via hardware virtualization extensions

Proceedings of the 15th ACM conference on Computer and communications security
BitBlaze: A New Approach to Computer Security via Binary Analysis

ICISS '08 Proceedings of the 4th International Conference on Information Systems Security
CloudAV: N-version antivirus in the network cloud

SS'08 Proceedings of the 17th conference on Security symposium
Improving malware detection by applying multi-inducer ensemble

Computational Statistics & Data Analysis
Virtualized in-cloud security services for mobile devices

Proceedings of the First Workshop on Virtualization in Mobile Computing
The SHOGUN Machine Learning Toolbox

The Journal of Machine Learning Research
Malware detection using assembly and API call sequences

Journal in Computer Virology
Improving antivirus accuracy with hypervisor assisted analysis

Journal in Computer Virology
Malware images: visualization and automatic classification

Proceedings of the 8th International Symposium on Visualization for Cyber Security
Combining file content and file relations for cloud based malware detection

Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining
Graph-based malware detection using dynamic analysis

Journal in Computer Virology
Polymorphic worm detection using structural information of executables

RAID'05 Proceedings of the 8th international conference on Recent Advances in Intrusion Detection

Discriminant malware distance learning on structural information for automated malware classification

Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining
Malware analysis method using visualization of binary files

Proceedings of the 2013 Research in Adaptive and Convergent Systems
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles

Proceedings of the 29th Annual Computer Security Applications Conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

Malware classification systems have typically used some machine learning algorithm in conjunction with either static or dynamic features collected from the binary. Recently, more advanced malware has introduced mechanisms to avoid detection in these views by using obfuscation techniques to avoid static detection and execution-stalling techniques to avoid dynamic detection. In this paper we construct a classification framework that is able to incorporate both static and dynamic views into a unified framework in the hopes that, while a malicious executable can disguise itself in some views, disguising itself in every view while maintaining malicious intent will prove to be substantially more difficult. Our method uses kernels to place a similarity metric on each distinct view and then employs multiple kernel learning to find a weighted combination of the data sources which yields the best classification accuracy in a support vector machine classifier. Our approach opens up new avenues of malware research which will allow the research community to elegantly look at multiple facets of malware simultaneously, and which can easily be extended to integrate any new data sources that may become popular in the future.