Scalable Telemetry Classification for Automated Malware Detection

Abstract

Abstract. Industry reports and blogs have estimated the amount of malware based on known malicious files. This paper extends this analysis to the amount of unknown malware. The study is based on 26.7 million files referenced in telemetry reports from 50 million computers running commercial anti-malware (AM) products. To estimate the undetected malware, a classifier predicts the underlying nature of unknown files recorded in the telemetry reports. The telemetry classifier predicts that 69.6% (4.27 million) of the unknown files are malicious. Assuming the unknown files predicted to be malicious by the classifier are malware, the telemetry classifier also allows us to estimate the efficacy of the AM system indicating that signatures detected 82.8% (20.6 million) of the malicious files. We have validated our system by conducting a longitudinal study to measure the false positive and false negative rates over a period of thirteen months.

An ensemble framework for interpretable malicious code detection

“…However, with the pervasiveness automated malware development toolkits, code obfuscation and other concealment techniques are adopted to conduct evolutions in malicious codes so as to evade the detection 10 . Therefore, cloud‐based malware detection was presented to keep the effectiveness in performance 11 . With an inspection on signature library at the client side, reliable programs are authorized while unreliable ones are rejected.…”

“…10 Therefore, cloud-based malware detection was presented to keep the effectiveness in performance. 11 With an inspection on signature library at the client side, reliable programs are authorized while unreliable ones are rejected. At the same time, the server in cloud side makes a strategic decision on unseen programs and reaches a verdict to the clients.…”