arXiv 1609.024042016-09-08cs.CR

ITect: Scalable Information Theoretic Similarity for Malware Detection

Sukriti Bhattacharya, Hector D. Menendez, Earl Barr, David Clark

备注：: 14 pages

英文摘要：

Malware creators have been getting their way for too long now. String-based similarity measures can leverage ground truth in a scalable way and can operate at a level of abstraction that is difficult to combat from the code level. We introduce ITect, a scalable approach to malware similarity detection based on information theory. ITect targets file entropy patterns in different ways to achieve 100% precision with 90% accuracy but it could target 100% recall instead. It outperforms VirusTotal for precision and accuracy on combined Kaggle and VirusShare malware.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

阅读原文

阅读 PDF ↗

arXiv 页面 ↗HTML 原文 ↗

本文内容

英文摘要相关论文

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

继续探索

相关论文

Malware Detection and Analysis: Challenges and Research Opportunities

Malwares are continuously growing in sophistication and numbers. Over the last decade, remarkable progress has been achieved in anti-malware mechanisms. However, several pressing issues (e.g., unknown malware samples detection) still need to be addressed adequately. This article first presents a concise overview of malware along with anti-malware and then summarizes various research challenges. This is a theoretical and perspective article that is hoped to complement earlier articles and works.

2021-01-21cs.CR

Personal Mobile Malware Guard PMMG: a mobile malware detection technique based on user's preferences

Mobile malware has increased rapidly last 10 years. This rapid increase is due to the rapid enhancement of mobile technology and their power to do most work for their users. Since mobile devices are personal devices, then a special action must be taken towards preserving privacy and security of the mobile data. Malware refers to all types of software applications with malicious behavior. In this paper, we propose a malware detection technique called Personal Mobile Malware Guard ? PMMG- that classifies malwares based on the mobile user feedback. PMMG controls permissions of different applicati…

2018-02-12cs.CR

An Information-Theoretical View of Network-Aware Malware Attacks

This work investigates three aspects: (a) a network vulnerability as the non-uniform vulnerable-host distribution, (b) threats, i.e., intelligent malwares that exploit such a vulnerability, and (c) defense, i.e., challenges for fighting the threats. We first study five large data sets and observe consistent clustered vulnerable-host distributions. We then present a new metric, referred to as the non-uniformity factor, which quantifies the unevenness of a vulnerable-host distribution. This metric is essentially the Renyi information entropy and better characterizes the non-uniformity of a distr…

2008-09-08cs.CRcs.ITcs.NI

Game-Theoretic Malware Detection

Malware attacks are costly. To mitigate against such attacks, organizations deploy malware detection tools that help them detect and eventually resolve those threats. While running only the best available tool does not provide enough coverage of the potential attacks, running all available tools is prohibitively expensive in terms of financial cost and computing resources. Therefore, an organization typically runs a set of tools that maximizes their coverage given a limited budget. However, how should an organization choose that set? Attackers are strategic, and will change their behavior to p…

2022-01-07cs.CRcs.GT

PAD：面向规避攻击的原则性对抗恶意软件检测

PAD: Towards Principled Adversarial Malware Detection Against Evasion Attacks

Nanjing University of Posts and Telecommunications（南京邮电大学）；Nanjing Institute of Technology（南京工程学院）；University of Colorado Colorado Springs（科罗拉多大学斯普林斯分校）

本文提出PAD对抗训练框架，通过可学习凸度量量化分布级离散扰动并提供收敛保证，在两个Android恶意软件数据集上显著提升防御效果，抵御27种规避攻击时检测准确率超83.45%，无攻击时准确率下降小于2.16%。

2023-04-06cs.CRcs.LGstat.ML

Mal2GCN: A Robust Malware Detection Approach Using Deep Graph Convolutional Networks With Non-Negative Weights

Sharif University of Technology（谢里夫理工大学）

With the growing pace of using Deep Learning (DL) to solve various problems, securing these models against adversaries has become one of the main concerns of researchers. Recent studies have shown that DL-based malware detectors are vulnerable to adversarial examples. An adversary can create carefully crafted adversarial examples to evade DL-based malware detectors. In this paper, we propose Mal2GCN, a robust malware detection model that uses Function Call Graph (FCG) representation of executable files combined with Graph Convolution Network (GCN) to detect Windows malware. Since FCG represent…

2022-03-12cs.CRcs.LG

更多相关论文收起更多论文

Detecting Malware with Information Complexity

This work focuses on a specific front of the malware detection arms-race, namely the detection of persistent, disk-resident malware. We exploit normalised compression distance (NCD), an information theoretic measure, applied directly to binaries. Given a zoo of labelled malware and benign-ware, we ask whether a suspect program is more similar to our malware or to our benign-ware. Our approach classifies malware with 97.1% accuracy and a false positive rate of 3%. We achieve our results with off-the-shelf compressors and a standard machine learning classifier and without any specialised knowled…

2015-02-26cs.CCcs.CR

特征工程能否助力量子机器学习用于恶意软件检测？

Can Feature Engineering Help Quantum Machine Learning for Malware Detection?

Univ. of Maryland, Baltimore County（马里兰大学巴尔的摩县分校）

本文提出将理论量子机器学习与XGBoost特征选择相结合的混合框架，以减少恶意软件检测的数据规模和训练时间，并在模拟器及IBM量子设备上验证了其有效性。

2023-08-09cs.AIcs.CRcs.LG

When a RF Beats a CNN and GRU, Together -- A Comparison of Deep Learning and Classical Machine Learning Approaches for Encrypted Malware Traffic Classification

Ariel University（阿里埃勒大学）

Internet traffic classification is widely used to facilitate network management. It plays a crucial role in Quality of Services (QoS), Quality of Experience (QoE), network visibility, intrusion detection, and traffic trend analyses. While there is no theoretical guarantee that deep learning (DL)-based solutions perform better than classic machine learning (ML)-based ones, DL-based models have become the common default. This paper compares well-known DL-based and ML-based models and shows that in the case of malicious traffic classification, state-of-the-art DL-based solutions do not necessaril…

2022-06-16cs.CRcs.LG

Malicious Software Detection and Classification utilizing Temporal-Graphs of System-call Group Relations

In this work we propose a graph-based model that, utilizing relations between groups of System-calls, distinguishes malicious from benign software samples and classifies the detected malicious samples to one of a set of known malware families. More precisely, given a System-call Dependency Graph (ScDG) that depicts the malware's behavior, we first transform it to a more abstract representation, utilizing the indexing of System-calls to a set of groups of similar functionality, constructing thus an abstract and mutation-tolerant graph that we call Group Relation Graph (GrG); then, we construct …

2018-12-27cs.CR

DRSM：在恶意软件分类器上提供认证鲁棒性的去随机化平滑

DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness

University of Maryland - College Park（马里兰大学帕克分校）

本文提出 DRSM，通过窗口消融的去随机化平滑为恶意软件静态检测提供认证鲁棒性，并发布 PACE 良性可执行文件数据集。

2023-10-03cs.CRcs.LG

协同引导执行与LLM驱动分析用于零日AI生成恶意软件检测

Synergistic Directed Execution and LLM-Driven Analysis for Zero-Day AI-Generated Malware Detection

本文提出了一种结合协同执行与LLM驱动分析的框架，用于高效检测零日AI生成恶意软件，通过改进的路径优先级和反馈机制提升检测准确率。

2026-03-10cs.CRcs.SE

基于GPT-4的提示工程辅助恶意软件动态分析

Prompt Engineering-assisted Malware Dynamic Analysis Using GPT-4

Guangdong Key Laboratory of Intelligent Information Processing（广东省智能信息处理重点实验室）；Shenzhen Key Laboratory of Media Security（深圳市媒体安全重点实验室）

针对现有基于API序列的恶意软件检测模型表示质量有限、泛化能力弱及概念漂移问题，提出结合GPT-4提示工程生成API解释文本、用BERT获取序列表示再经CNN检测的方法，在多基准及跨库、小样本实验中性能优于TextCNN，泛化性优异。

2023-12-13cs.AIcs.CR

Malicious Network Traffic Detection via Deep Learning: An Information Theoretic View

The Johns Hopkins University（约翰斯·霍普金斯大学）

The attention that deep learning has garnered from the academic community and industry continues to grow year over year, and it has been said that we are in a new golden age of artificial intelligence research. However, neural networks are still often seen as a "black box" where learning occurs but cannot be understood in a human-interpretable way. Since these machine learning systems are increasingly being adopted in security contexts, it is important to explore these interpretations. We consider an Android malware traffic dataset for approaching this problem. Then, using the information plan…

2020-09-16cs.CRcs.ITcs.LG