Combining file content and file relations for cloud based malware detection

Abstract

Due to their damages to Internet security, malware (such as virus, worms, trojans, spyware, backdoors, and rootkits) detection has caught the attention not only of anti-malware industry but also of researchers for decades. Resting on the analysis of file contents extracted from the file samples, like Application Programming Interface (API) calls, instruction sequences, and binary strings, data mining methods such as Naive Bayes and Support Vector Machines have been used for malware detection. However, besides file contents, relations among file samples, such as a "Downloader" is always associated with many Trojans, can provide invaluable information about the properties of file samples. In this paper, we study how file relations can be used to improve malware detection results and develop a file verdict system (named "Valkyrie") building on a semi-parametric classifier model to combine file content and file relations together for malware detection. To the best of our knowledge, this is the first work of using both file content and file relations for malware detection. A comprehensive experimental study on a large collection of PE files obtained from the clients of anti-malware products of Comodo Security Solutions Incorporation is performed to compare various malware detection approaches. Promising experimental results demonstrate that the accuracy and efficiency of our Valkyrie system outperform other popular anti-malware software tools such as Kaspersky AntiVirus and McAfee VirusScan, as well as other alternative data mining based detection systems. Our system has already been incorporated into the scanning tool of Comodo's Anti-Malware software.

An Open Source, Extensible Malware Analysis Platform

“…The anti-malware software widely uses the signature-based method to identify the known threats/malware. A signature is a short sequence of bytes that uniquely characterizes any malware [5]. The signatures are created manually by an analyst by analyzing the malware.…”

“…Comodo's Anti-Virus products [5,26,27] and Symantec Anti-Malware products [28]. These methods have better results but still fail to avoid false alarms on one hand and fail to detect novel malware on the other hand.…”

“…However, these anti-malwares mainly employ signature based, heuristic based and hybrid methods to detect such attacks. Signature based methods are given a signature, which is a sequence of bytes characterizing a malware uniquely and identifies if a given software is a malware by looking up the signatures in the software [5]. However, this method is strongly retrospective and fail to detect novel malwares as well as variant of known malwares since malware developers keep changing the same malware code (using developed toolkits [6,7,8]) to avoid detection by employing various techniques, e.g., polymorphism, instruction virtualization, to name a few.…”

Graph-based malware distributors detection

“…Due to Internet propagation malware has been rapidly spreading and infecting computers around the world at an unprecedented rate [1] and malware detection became one of the top internet security topics [2,11,3]. Security software developers reported that the release rate of malicious code and other unwanted programs may be exceeding that of legitimate software applications [11].…”

“…Web services enable the identification of malware with a huge partners data about viruses collected, e.g. virustotal.com 1 . But even a huge malware database does not guarantee detection of new ones.…”