Correlating High- and Low-Level Features:

Banin, Sergii; Dyrkolbotn, Geir Olav

doi:10.1007/978-3-030-26834-3_9

Cited by 4 publications

(12 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…During their studies authors discovered a following problem: memory access patterns provide little context to a human analyst as it is almost impossible to understand which part of the execution flow created a distinctive memory access pattern. To eliminate this knowledge gap, in their next paper [8] they performed an attempt to "correlate" memory access patterns (as low-level features) with API calls (as high-level features). Together with memory access operations they recorded API calls performed by malicious executables.…”

Section: Related Workmentioning

confidence: 99%

“…Memory access operations (BEP or AEP respectively) are concatenated into memory access sequence. Based on the methods used in [8] we split memory access sequence produced by an executable into a set of subsequences: n-grams of the length 96. These n-grams are overlapping, so every next n-gram begins from the second element of the previous one.…”

Section: Feature Construction and Selectionmentioning

confidence: 99%

“…The research leading to these results has received funding from the Center for Cyber and Information Security, under budget allocation from the Ministry of Justice and Public Security of Norway features represent the behavior of malware when it runs and can be roughly divided into high-and low-level features [8]. API and system calls, network and file activity are some of the high-level features, while memory access operations, opcodes or hardware performance counters are the low-level features.…”

Section: Introductionmentioning

confidence: 99%

“…The problem with low-level features is that it is hard for a human analyst to understand the context under which a certain pattern has occurred. A previous work [8] presented an attempt to fill the gap between low-level activity (memory access patterns) and its high-level (more human understandable API calls) representation. During the study it was also found, that under the experimental design used in [8] and [7] most of the recorded behavioral activity emerged not from the main module of an executable (after the Entry Point 1 -AEP) but prior to the moment when instruction pointer (IP) is set to the Entry Point (before the Entry Point -BEP).…”

Section: Introductionmentioning

confidence: 99%

“…A previous work [8] presented an attempt to fill the gap between low-level activity (memory access patterns) and its high-level (more human understandable API calls) representation. During the study it was also found, that under the experimental design used in [8] and [7] most of the recorded behavioral activity emerged not from the main module of an executable (after the Entry Point 1 -AEP) but prior to the moment when instruction pointer (IP) is set to the Entry Point (before the Entry Point -BEP). Without going into much details (see Section 2 for details) these findings showed, that it is potentially possible to detect running malicious executable before it starts executing the logic that was put into it by the creator.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Detection of Running Malware Before it Becomes Malicious

Banin¹,

Dyrkolbotn²

2020

Advances in Information and Computer Security

Self Cite

View full text Add to dashboard Cite

As more vulnerabilities are being discovered every year[17], malware constantly evolves forcing improvements and updates of security and malware detection mechanisms. Malware is used directly on the attacked systems, thus anti-virus solutions tend to neutralize malware by not letting it launch or even being stored in the system. However, if malware is launched it is important to stop it as soon as the maliciousness of a new process has been detected. Following the results from [8] in this paper we show, that it is possible to detect running malware before it becomes malicious. We propose a novel malware detection approach that is capable of detecting Windows malware on the earliest stage of execution. The accuracy of more than 99% has been achieved by finding distinctive low-level behavior patterns generated before malware reaches it's entry point. We also study the ability of our approach to detect malware after it reaches it's entry point and to distinguish between benign executables and 10 malware families.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Feature Construction and Selectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Detection of Running Malware Before it Becomes Malicious

Banin¹,

Dyrkolbotn²

2020

Advances in Information and Computer Security

Self Cite

View full text Add to dashboard Cite

show abstract

Fast and Straightforward Feature Selection Method

Banin¹

2020

Malware Analysis Using Artificial Intelligence and Deep Learning

View full text Add to dashboard Cite

Detection of Previously Unseen Malware using Memory Access Patterns Recorded Before the Entry Point

Banin

Dyrkolbotn

2020

2020 IEEE International Conference on Big Data (Big Data)

Self Cite

View full text Add to dashboard Cite

Recently it has been shown, that it is possible to detect malware based on the memory access patterns produced before executions reaches its Entry Point. In this paper, we investigate the usefulness of memory access patterns over time, i.e to what extent can machine learning algorithm trained on "old" data, detect new malware samples, that was not part of the training set and how does this performance change over time.During our experiments, we found that machine learning models trained on memory access patterns of older samples can provide both high accuracy and a high true positive rate for the period from several months to almost a year from the update of the model. We also perform a substantial analysis of our findings that may aid researchers who work with malware and Big Data.

show abstract

Correlating High- and Low-Level Features:

Cited by 4 publications

References 11 publications

Detection of Running Malware Before it Becomes Malicious

Detection of Running Malware Before it Becomes Malicious

Fast and Straightforward Feature Selection Method

Detection of Previously Unseen Malware using Memory Access Patterns Recorded Before the Entry Point

Contact Info

Product

Resources

About