MalPhase：使用网络流数据的细粒度恶意软件检测
MalPhase: Fine-Grained Malware Detection Using Network Flow Data
摘要：
经济激励鼓励恶意软件作者不断开发新的、越来越复杂的恶意软件，以窃取敏感数据或勒索个人和公司支付巨额赎金。2017年，网络攻击对全球经济的影响估计在4450亿至6000亿美元之间，占全球GDP的0.8%。传统上，用于防御恶意软件的方法之一是网络流量分析，其依赖于网络数据来检测潜在恶意软件的存在。然而，为了跟上不断增长的网络速度和流量，网络分析通常仅限于处理聚合的网络数据，这在传统上具有挑战性，并且会产生混合结果。在本文中，我们提出了MalPhase，一个系统，旨在应付聚合流的局限性。MalPhase具有用于恶意软件检测、类型和家族分类的多阶段管道。使用扩展的网络流功能集和同步多层架构有助于提高深度学习模型的性能，使其能够检测恶意流（>98% F1）并将其分类为相应的恶意软件类型（>93% F1）和家族（>91% F1）。此外，使用强大的功能和去噪自动编码器允许MalPhase在混合了不同数量的良性流量的样本上表现良好。最后，MalPhase可以检测到看不见的恶意软件样本，其性能与已知样本相当，即使与良性流交织以反映真实的网络环境。
英文摘要：
Economic incentives encourage malware authors to constantly develop new, increasingly complex malware to steal sensitive data or blackmail individuals and companies into paying large ransoms. In 2017, the worldwide economic impact of cyberattacks is estimated to be between 445 and 600 billion USD, or 0.8% of global GDP. Traditionally, one of the approaches used to defend against malware is network traffic analysis, which relies on network data to detect the presence of potentially malicious software. However, to keep up with increasing network speeds and amount of traffic, network analysis is generally limited to work on aggregated network data, which is traditionally challenging and yields mixed results. In this paper we present MalPhase, a system that was designed to cope with the limitations of aggregated flows. MalPhase features a multi-phase pipeline for malware detection, type and family classification. The use of an extended set of network flow features and a simultaneous multi-tier architecture facilitates a performance improvement for deep learning models, making them able to detect malicious flows (>98% F1) and categorize them to a respective malware type (>93% F1) and family (>91% F1). Furthermore, the use of robust features and denoising autoencoders allows MalPhase to perform well on samples with varying amounts of benign traffic mixed in. Finally, MalPhase detects unseen malware samples with performance comparable to that of known samples, even when interlaced with benign flows to reflect realistic network environments.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
