Improving file-level fuzzy hashes for malware variant classification

Shiel, Ian; O’Shaughnessy, Stephen

doi:10.1016/j.diin.2019.01.018

Cited by 17 publications

(12 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Typically, packed malware will contain the compressed malware and a decryption engine that will undo the compression at runtime. We experimented with packed malware but the results were omitted because recent work has shown that entropy, section hashing, and consistently executing graph mining can be used to classify packed malware [31]- [33]. Being able to be detected using entropy and hashing approaches leads us to believe packing is not well-suited for use in adversarial example generation.…”

Section: ) Obfuscation Resultsmentioning

confidence: 99%

Generation & Evaluation of Adversarial Examples for Malware Obfuscation

Park

Khan

Yener

2019

2019 18th IEEE International Conference on Machine Learning and Applications (ICMLA)

View full text Add to dashboard Cite

There has been an increased interest in the application of convolutional neural networks for image based malware classification, but the susceptibility of neural networks to adversarial examples allows malicious actors to evade classifiers. Adversarial examples are usually generated by adding small perturbations to the input that are unrecognizable to humans, but the same approach is not effective with malware. In general, these perturbations cause changes in the byte sequences that change the initial functionality or result in un-executable binaries. We present a generative model for executable adversarial malware examples using obfuscation that achieves a high misclassification rate, up to 100% and 98% in white-box and black-box settings respectively, and demonstrates transferability. We further evaluate the effectiveness of the proposed method by reporting insignificant change in the evasion rate of our adversarial examples against popular defense strategies.

show abstract

Section: ) Obfuscation Resultsmentioning

confidence: 99%

Generation & Evaluation of Adversarial Examples for Malware Obfuscation

Park

Khan

Yener

2019

2019 18th IEEE International Conference on Machine Learning and Applications (ICMLA)

View full text Add to dashboard Cite

show abstract

“…A case in point is the famous WannaCry ransomware contained code fragments that have been seen before in malware samples associated with the Lazarus threat actor group and this feature reuse was key to the attribution of the malware to North Korea. 16 This means that malware can be clustered using fuzzy hashing [41], [42], [43], [44], [45], [46], [47] when the attackers reuse features, even though the variants have different cryptographic hashes. For threat intelligence, this means that if two or more malware samples have high similarities using the concept of CTPH, we can hypothesize that the samples are from the same threat group, the result of collaboration between threat groups or built from the same malware builder program, which enables threat attribution at tactical/technical level which involves attributing APTs with connections to nation-state actors.…”

Section: Background a Fuzzy Hashesmentioning

confidence: 99%

Nation-State Threat Actor Attribution Using Fuzzy Hashing

Kida¹,

Olukoya²

2023

IEEE Access

View full text Add to dashboard Cite

Recent years have seen a rise in state-sponsored malware. Advanced Persistent Threat groups (APTs) have been waging a covert war with little repercussions due to the clandestine nature of cyberconflict. For sanctions to be imposed, malware attribution is an important stage in the attack analysis because the exploitation of known vulnerabilities via malware execution is one of the methods APT attackers use to establish a foothold in the target's network. Prior attempts at automated attack attribution use behaviour report from sandboxes as inputs into machine learning algorithms. Whilst this is a good and reliable approach, it has some limitations. For example, some APT files may detect that they are in a sandboxed environment and stop execution or behave differently leading to false or no attributions. Hence, there is a need for an alternative feature extraction technique for attack attribution. This research proposes a novel framework for a lightweight and automated attack attribution that uses fuzzy hashes as natural language input for machine learning classifiers to attribute attacks. Experimental results show that the proposed framework attributes attack with average accuracy and F1-score of 89% and 87.5% for the country and APT group classification. In addition, we demonstrate how the proposed approach provides a faster and lightweight method of attack attribution, enhances advanced analysis of samples, and generates competitive performance with state-ofthe-art dynamic analysis attribution engines.

show abstract

“…For example, Ian Shiel et al in their work [4] proposed a method of improving the fuzzy hashing algorithm by applying it to each section of a binary PE file. With their research, the authors solve the problem of detecting malicious software for the Windows OS, in which, by design, there are sections common to all files, developers can change the order of program sections or insert additional sections to complicate its identification.…”

Section: Literature Analysismentioning

confidence: 99%

Semantic analysis and classification of malware for UNIX-likeoperating systems with the use of machine learning methods

Mishchenko¹,

Dorosh²

2022

AAIT

View full text Add to dashboard Cite

The paper focuses on malware classification, based on semantic analysis of disassembled binaries sections’ opcodes with the use of n-grams, TF-IDF indicator and machine learning algorithms. The purpose of the research is to improve and extend the variety of methods for identifying malware developed for UNIX-likeoperating systems. The taskof the research is to create an algorithm, which can identify the types of threats in malicious binary files using n-grams, TF-IDF indicator and machine learning algorithms. Malware classification process can be based either on static or dynamic signatures. Static signatures can be represented as byte-code sequences, binary-assembled instructions, or importedlibraries. Dynamic signatures can be represented as the sequence of actions made by malware. We will use a static signatures strategy for semantic analysis and classification of malware. In this paper,we will work with binary ELF files, which is the mostcommon executable file type for UNIX-likeoperating systems. For the purpose of this research we gathered 2999 malwareELFfiles, using data from VirusShare and VirusTotal sites, and 959 non malware program files from /usr/bin directory in Linux operatingsystem. Each malware file represents one of 3 malware families: Gafgyt, Mirai, and Lightaidra, which are popular and harmful threats to UNIX systems. Each ELF file in dataset was labelled according to its type. The proposed classification algorithm consists of several preparation steps: disassembly of every ELF binary file from the dataset and semantically processing and vectorizing assembly instructions in each file section. For the settingclassification threshold, the Multinomial Naive Bayes model is used. Using the classification threshold, we define the sizefor n-grams and the section of the file, which will give the best classification results. For obtaining the best score, multiple machine learning models, along with hyperparameter optimization, will be used. As a metric of the accuracy of the designed algorithm, mean accuracy and weighted F1 score are used. Stochastic gradient descent for SVM model was selected as the best performing ML model, based on the obtained experimental results.Developed algorithm was experimentally proved to be effective for classifying malware for UNIX operating systems. Results were analyzed and used for making conclusions and suggestions for future work

show abstract

Improving file-level fuzzy hashes for malware variant classification

Cited by 17 publications

References 3 publications

Generation & Evaluation of Adversarial Examples for Malware Obfuscation

Generation & Evaluation of Adversarial Examples for Malware Obfuscation

Nation-State Threat Actor Attribution Using Fuzzy Hashing

Semantic analysis and classification of malware for UNIX-likeoperating systems with the use of machine learning methods

Contact Info

Product

Resources

About