Echelon：针对原始可执行文件的双层恶意软件检测，以减少误报
Echelon: Two-Tier Malware Detection for Raw Executables to Reduce False Alarms
摘要：
现有的恶意软件检测方法由于单层分类方法而遭受假阳性率（FPR）和真阳性率（TPR）之间的简单化权衡，其中这两种测量彼此不利地影响。恶意软件检测的实际含义是FPR必须保持在可接受的低水平，而TPR保持在高水平。为此，我们提出了一个两层的学习，称为“梯队”，从原始字节数据，不需要手工制作的功能。第一层将FPR锁定在指定的目标水平，而第二层在保持锁定的FPR的同时提高TPR。Echelon算法的核心在于提取第一层模型中隐藏层的激活信息，以构建更强的第二层模型。Echelon是一个框架，因为它允许任何现有的基于CNN的模型在两个层中进行调整。我们目前的实验结果评估Echelon适应国家的最先进的恶意软件检测模型"Malconv”在第一和第二层。
英文摘要：
Existing malware detection approaches suffer from a simplistic trade-off between false positive rate (FPR) and true positive rate (TPR) due to a single tier classification approach, where the two measures adversely affect one another. The practical implication for malware detection is that FPR must be kept at an acceptably low level while TPR remains high. To this end, we propose a two-tiered learning, called ``Echelon", from raw byte data with no need for hand-crafted features. The first tier locks FPR at a specified target level, whereas the second tier improves TPR while maintaining the locked FPR. The core of Echelon lies at extracting activation information of the hidden layers of first tier model for constructing a stronger second tier model. Echelon is a framework in that it allows any existing CNN based model to be adapted in both tiers. We present experimental results of evaluating Echelon by adapting the state-of-the-art malware detection model ``Malconv" in the first and second tiers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
