MalDICT：关于恶意软件行为、平台、漏洞利用和加壳工具的基准数据集
MalDICT: Benchmark Datasets on Malware Behaviors, Platforms, Exploitation, and Packers
AI总结：
本文针对恶意软件行为、平台、漏洞利用和加壳工具四项分类任务，利用ClarAVy工具构建并发布了总计近550万个恶意文件的基准数据集。
摘要：
现有的恶意软件分类研究几乎只关注两个任务：区分恶意与良性文件，以及按家族对恶意软件进行分类。然而，恶意软件还可以根据许多其他类型的属性进行分类，利用机器学习识别新出现的恶意软件中的这些属性，能为分析人员提供重要价值。特别是，我们发现了在以往工作中较少涉及的四个任务：按恶意软件展现的行为、运行的平台、利用的漏洞以及使用的加壳工具进行分类。为了获取用于在这些任务上训练和评估 ML 分类器的标签，我们创建了一款名为 ClarAVy 的杀毒软件（AV）标记工具。ClarAVy 复杂的 AV 标签解析器有别于以往基于 AV 的标记工具，能够准确解析 90 款不同 AV 产品使用的 882 种不同的 AV 标签格式。我们为这四个分类任务分别发布了基准数据集，这些数据集使用 ClarAVy 进行标记，总计包含近 550 万个恶意文件。我们的恶意软件行为数据集包含 75 个不同的标签，几乎是唯一具有行为标签的先前基准数据集的 7 倍。据我们所知，我们是首个发布带有恶意软件平台和加壳工具标签数据集的团队。
英文摘要：
Existing research on malware classification focuses almost exclusively on two tasks: distinguishing between malicious and benign files and classifying malware by family. However, malware can be categorized according to many other types of attributes, and the ability to identify these attributes in newly-emerging malware using machine learning could provide significant value to analysts. In particular, we have identified four tasks which are under-represented in prior work: classification by behaviors that malware exhibit, platforms that malware run on, vulnerabilities that malware exploit, and packers that malware are packed with. To obtain labels for training and evaluating ML classifiers on these tasks, we created an antivirus (AV) tagging tool called ClarAVy. ClarAVy's sophisticated AV label parser distinguishes itself from prior AV-based taggers, with the ability to accurately parse 882 different AV label formats used by 90 different AV products. We are releasing benchmark datasets for each of these four classification tasks, tagged using ClarAVy and comprising nearly 5.5 million malicious files in total. Our malware behavior dataset includes 75 distinct tags - nearly 7x more than the only prior benchmark dataset with behavioral tags. To our knowledge, we are the first to release datasets with malware platform and packer tags.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
