Automatic analysis of malware behavior using machine learning

Abstract

Malicious software -so called malware -poses a major threat to the security of computer systems. The amount and diversity of its variants render classic security defenses ineffective, such that millions of hosts in the Internet are infected with malware in the form of computer viruses, Internet worms and Trojan horses. While obfuscation and polymorphism employed by malware largely impede detection at file level, the dynamic analysis of malware binaries during run-time provides an instrument for characterizing and defending against the threat of malicious software.In this article, we propose a framework for the automatic analysis of malware behavior using machine learning. The framework allows for automatically identifying novel classes of malware with similar behavior (clustering) and assigning unknown malware to these discovered classes (classification). Based on both, clustering and classification, we propose an incremental approach for behavior-based analysis, capable of processing the behavior of thousands of malware binaries on a daily basis. The incremental analysis significantly reduces the run-time overhead of current analysis methods, while providing accurate discovery and discrimination of novel malware variants.

Research Priorities for Robust and Beneficial Artificial Intelligence

“…These techniques could be applied to the detection of intrusions (Lane 2000), analyzing malware (Rieck et al 2011), or detecting potential exploits in other programs through code analysis (Brun and Ernst 2004). It is not implausible that cyberattack between states and private actors will be a risk factor for harm from near-future AI systems, motivating research on preventing harmful events.…”

CloudIDEA: A Malware Defense Architecture for Cloud Data Centers

“…Also, malware samples that do not belong to the previously defined families can be added as prototypes to the clustering or classification schemes. This method has shown success in the previously published work [35].…”

Kutatási prioritások a megbízható és hasznos mesterséges intelligencia létrehozásáért

“…Ezek a technológiák alkalmazhatók a külön-böző jogtalan behatolások észlelésére (Lane, 2000), a rosszindulatú szoftverek (malware) azonosítására (Rieck et al, 2011), vagy esetleges sérülékenységek feltárására egyéb programok forráskódjának elemzése során (Brun -Ernst, 2004). Nem elképzelhetetlen, hogy az államok és a privát entitások között zajló kibertámadások is alkalmaznak majd a közel-jövőben MI megoldásokat, ezáltal olyan rizikófaktort jelentenek, ami további kutatásokat motivál a káresemények elkerülése érdekében.…”