National security is threatened by malware, which remains one of the most dangerous and costly cyber threats. As of last year, researchers reported 1.3 billion known malware specimens, motivating the use of data-driven machine learning (ML) methods for analysis. However, shortcomings in existing ML approaches hinder their mass adoption. These challenges include detection of novel malware and the ability to perform malware classification in the face of class imbalance: a situation where malware families are not equally represented in the data. Our work addresses these shortcomings with MalwareDNA: an advanced dimensionality reduction and feature extraction framework. We demonstrate stable task performance under class imbalance for the following tasks: malware family classification and novel malware detection with a trade-off in increased abstention or reject-option rate.
Unsupervised Anomaly-based Malware Detection using Hardware Features
最近的工作已经显示出使用微架构执行模式来检测恶意软件程序的前景。这些检测器属于一类被称为基于签名的检测器的检测器，因为它们通过将程序的执行模式（签名）与已知恶意软件程序的执行模式进行比较来捕获恶意软件。在这项工作中，我们提出了一类新的检测器-基于异常的硬件恶意软件检测器-不需要签名的恶意软件检测，从而可以捕捉到更广泛的恶意软件，包括潜在的新颖的。我们使用无监督的机器学习来基于性能计数器的数据构建正常程序执行的配置文件，并使用这些配置文件来检测由于恶意软件利用而发生的程序行为的重大偏差。我们表明，在Windows/x86平台上的流行程序，如IE和Adobe PDF Reader的现实世界中的剥削，可以检测到几乎完美的确定性。我们还研究了在面对试图逃避基于异常的检测的复杂对手时实施这种方法的局限性和挑战。所提出的检测器是补充以前提出的基于签名的检测器，可以一起使用，以提高安全性。
Semi-supervised Classification of Malware Families Under Extreme Class Imbalance via Hierarchical Non-Negative Matrix Factorization with Automatic Model Selection
本文提出一种名为 HNMFk Classifier 的分层半监督算法，基于带自动模型选择的非负矩阵分解，通过支持弃权（不执行）预测，在极端类别不平衡和标注数据稀缺的情况下有效分类恶意软件家族并识别新型家族，在 EMBER-2018 数据集上取得 0.80 的 F1 分数。
Evaluating and Combating the Impact of Concept Drift on the Performance of Machine Learning-Based Phishing Detection Systems
Department of Computer Science, School of Mathematics, Computer Science and Engineering, City St George’s, University of London, UK（伦敦大学城市学院计算机科学系，数学、计算机科学与工程学院，伦敦大学）
