Malware Sequence Alignment

Dinh, Andrew; Brill, Daniel; Li, Yaohang; He, Wu

doi:10.1109/bdcloud-socialcom-sustaincom.2016.96

Cited by 6 publications

(2 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although the vast majority of previous works did not use long N -gram features for malware detection/classification, as done by DAEMON, a few exceptions exist. Dinh et al [42] employed the Smith-Waterman DNA sequence alignment algorithm in order to generate family signatures. They have found a few interesting sequences in the Ramnit and Lollipop families of Microsoft's dataset.…”

Section: B Static Analysismentioning

confidence: 99%

DAEMON: Dataset/Platform-Agnostic Explainable Malware Classification Using Multi-Stage Feature Mining

Korine

Hendler

2021

IEEE Access

View full text Add to dashboard Cite

Numerous metamorphic and polymorphic malicious variants are generated automatically on a daily basis. In order to do that, malware vendors employ mutation engines that transform the code of a malicious program while retaining its functionality, aiming to evade signature-based detection. These automatic processes have greatly increased the number of malware variants, deeming their fully-manual analysis impossible. Malware classification is the task of determining to which family a new malicious variant belongs. Variants of the same malware family show similar behavioral patterns. Thus, classifying newly discovered malicious programs and applications helps assess the risks they pose. Moreover, malware classification facilitates determining which of the newly discovered variants should undergo manual analysis by a security expert, in order to determine whether they belong to a new family (e.g., one whose members exploit a zero-day vulnerability) or are simply the result of a concept drift within a known malicious family. This motivated intense research in recent years on devising high-accuracy automatic tools for malware classification. In this work, we present DAEMON-a novel dataset-agnostic malware classifier.A key property of DAEMON is that the type of features it uses and the manner in which they are mined facilitate understanding the distinctive behavior or malware families, making its classification decisions explainable. We've optimized DAEMON using a large-scale dataset of x86 binaries, belonging to a mix of several malware families targeting computers running Windows. We then re-trained it and applied it, without any algorithmic change, feature re-engineering or parameter tuning, to two other large-scale datasets of malicious Android applications consisting of numerous malware families. DAEMON obtained highly accurate classification results on all datasets, establishing that it is not only dataset-agnostic but also platform-agnostic. We analyze DAEMON's classification models and provide numerous examples demonstrating how the features it uses facilitate explainability.INDEX TERMS malware classification, malware families, server-side polymorphism, static analysis.

show abstract

Section: B Static Analysismentioning

confidence: 99%

DAEMON: Dataset/Platform-Agnostic Explainable Malware Classification Using Multi-Stage Feature Mining

Korine

Hendler

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

“…packers can easily break many such patterns. Therefore, malware authors create various malware instances from the same malware family [22]. As a result, members of the same malware family are functionally identical, even though their binaries may greatly differ.…”

Section: Introductionmentioning

confidence: 99%

On the Effectiveness of Binary Emulation in Malware Classification

Vouvoutsis¹,

Casino²,

Patsakis³

2022

Preprint

View full text Add to dashboard Cite

Malware authors are continuously evolving their code base to include counter-analysis methods that can significantly hinder their detection and blocking. While the execution of malware in a sandboxed environment may provide a lot of insightful feedback about what the malware actually does in a machine, anti-virtualisation and hooking evasion methods may allow malware to bypass such detection methods. The main objective of this work is to complement sandbox execution with the use of binary emulation frameworks. The core idea is to exploit the fact that binary emulation frameworks may quickly test samples quicker than a sandbox environment as they do not need to open a whole new virtual machine to execute the binary. While with this approach, we lose the granularity of the data that can be collected through a sandbox, due to scalability issues, one may need to simply determine whether a file is malicious or to which malware family it belongs. To this end, we record the API calls that are performed and use them to explore the efficacy of using them as features for binary and multiclass classification. Our extensive experiments with real-world malware illustrate that this approach is very accurate, achieving state-of-the art outcomes with a statistically robust set of classification experiments while simultaneously having a relatively low computational overhead compared to traditional sandbox approaches. In fact, we compare the binary analysis results with a commercial sandbox, and our classification outperforms it at the expense of the fine-grained results that a sandbox provides.

show abstract