Research on the Construction of Malware Variant Datasets and Their Detection Method
Source abstract
Abstract
Malware detection is of great significance for maintaining the security of information systems. Malware obfuscation techniques and malware variants are increasingly emerging, but their samples and API (application programming interface) sequences are difficult to obtain. This poses difficulties for the development of malware variant detection models. To address this issue in this paper, we first generated a malware variant dataset using the obfuscation technique based on the disassembly and decompilation of malware. Then, an API call dataset of these malware variants was constructed through sandboxing. Compared to similar work, the malware variants and their obfuscated API call sequences generated in this paper were all runnable. After that, taking a public API call sequence dataset of obfuscation-free malware as input, a BERT (bidirectional encoder representation from transformers) pretrained model for malware detection was constructed. To enhance the ability of this pretrained model to handle obfuscation and variants, in this paper, we used adversarial training to improve the robustness and generalization of the detection model under obfuscation. As the experimental results show, the proposed scheme can improve the classification performance of malware variants under obfuscation. The accuracy of the malware variant classification was close to that of the unobfuscated case.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer Science and Engineering, Shandong University of Science and Technology, Qingdao 266590, China
Funding
the National Natural Science Foundation, China · the Taishan Scholars Program of Shandong Province · the Excellent Youth Innovation Team Foundation of Shandong Higher School · the Postdoctoral Innovation Foundation of Shandong Province · the Open Foundation of First Institute of Oceanography, China · the Distinguished Teachers Training Plan Program of Shandong University of Science and Technology
References (35)
Show source-provided references
1. Chen, Q., and Bridges, R.A. (2017, January 18–21). Automated Behavioral Analysis of Malware a Case Study of Wannacry Ransomware. Proceedings of the 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA), Cancun, Mexico.10.1109/ICMLA.2017.0-119 ↗
2. (2022, May 19). National Internet Emergency Center Network Security Information and Dynamic Weekly Report. Available online: https://www.cert.org.cn/publish/main/upload/File/202008.pdf.
3. Beijing Rising Network Security Technology Co., Ltd. (2021). 2020 China Network Security Report. Res. Inf. Secur., 7, 102–109.
4. Using Opcode Sequences in Single-Class Learning to Detect Unknown Malware10.1049/iet-ifs.2010.0180 ↗
5. Kimmell, J.C., Abdelsalam, M., and Gupta, M. (2021, January 23–27). Analyzing Machine Learning Approaches for Online Malware Detection in Cloud. Proceedings of the 2021 IEEE International Conference on Smart Computing (SMARTCOMP), Irvine, CA, USA.10.1109/SMARTCOMP52413.2021.00046 ↗
6. Aryal, K., Gupta, M., and Abdelsalam, M. (2021). A Survey on Adversarial Attacks for Malware Analysis. arXiv.
7. Lu, R. (2019). Malware Detection with Lstm Using Opcode Language. arXiv.
8. Raff, E., Barker, J., Sylvester, J., Brandon, R., Catanzaro, B., and Nicholas, C. (2017). Malware Detection by Eating a Whole Exe. arXiv.
9. Byte-Level Malware Classification Based on Markov Images and Deep Learning10.1016/j.cose.2020.101740 ↗
10. Shekhawat, N.S., and Mathew, R. (2021, January 28–29). A Review of Malware Classification Methods Using Machine Learning. Proceedings of the International Conference on IoT Based Control Networks & Intelligent Systems—ICICNIS 2021, Kottayama, India.10.2139/ssrn.3769906 ↗
11. An Investigation of Byte N-Gram Features for Malware Classification10.1007/s11416-016-0283-1 ↗
12. Classifying Malware Images with Convolutional Neural Network Models
13. Small Sample Malware Classification Method Based on Parameter Optimization Meta Learning and Difficult Sample Mining
14. A Malware Classification Method Based on Three Channel Image
15. Malware Detection Using Assembly and Api Call Sequences10.1007/s11416-010-0141-5 ↗
16. Eskandari, M., Khorshidpur, Z., and Hashemi, S. (2012, January 22–24). To Incorporate Sequential Dynamic Features in Malware Detection Engines. Proceedings of the European Intelligence & Security Informatics Conference, Odense, Denmark.10.1109/EISIC.2012.57 ↗
17. Asrafi, N. (2019, January 18–20). Comparing Performances of Graph Mining Algorithms to Detect Malware. Proceedings of the 2019 ACM Southeast Conference, Kennesaw, GA, USA.10.1145/3299815.3314485 ↗
18. McDole, A., Abdelsalam, M., Gupta, M., and Mittal, S. (2020, January 18–20). Analyzing Cnn Based Behavioural Malware Detection Techniques on Cloud Iaas. Proceedings of the International Conference on Cloud Computing, Honolulu, HI, USA.10.1007/978-3-030-59635-4_5 ↗
19. Recurrent Neural Networks Based Online Behavioural Malware Detection Techniques for Cloud Infrastructure10.1109/ACCESS.2021.3077498 ↗
20. McDole, A., Abdelsalam, M., Gupta, M., Mittal, S., and Alazab, M. (2021). Deep Learning Techniques for Behavioral Malware Analysis in Cloud Iaas. Malware Analysis Using Artificial Intelligence and Deep Learning, Springer.10.1007/978-3-030-62582-5_10 ↗
21. Muralidharan, T., Cohen, A., Gerson, N., and Nissim, N. (2022). File Packing from the Malware Perspective: Techniques, Analysis Approaches, and Directions for Enhancements. ACM Comput. Surv., accepted.10.1145/3530810 ↗
22. Rosenberg, I., Shabtai, A., Rokach, L., and Elovici, Y. (2018). Generic Black-Box End-to-End Attack against State of the Art Api Call Based Malware Classifiers. International Symposium on Research in Attacks, Intrusions, and Defenses, Springer.10.1007/978-3-030-00470-5_23 ↗
23. Blade: Robust Malware Detection against Obfuscation in Android
24. Yazi, A.F., Çatak, F.Ö., and Gül, E. (2019, January 24–26). Classification of Methamorphic Malware with Deep Learning (Lstm). Proceedings of the 27th IEEE Signal Processing and Applications Conference, Sivas, Turkey.10.1109/SIU.2019.8806571 ↗
25. Catak, F.O., and Yazi, A.F. (2019). A Benchmark Api Call Dataset for Windows Pe Malware Classification. arXiv.
26. Oliveira, A., and Sassi, R.J. (2019). Behavioral Malware Detection Using Deep Graph Convolutional Neural Networks. TechRxiv, preprint.
27. Banescu, S., Wüchner, T., Guggenmos, M., Ochoa, M., and Pretschner, A. (2015). Feebo: An Empirical Evaluation Framework for Malware Behavior Obfuscation. arXiv.
28. (2022, June 19). Virusshare. Available online: https://virusshare.com/.
29. Romain, T. (2022, June 19). Lief—Library to Instrument Executable Formats. Available online: https://lief.quarkslab.com/.
30. (2022, June 19). Malware Dataset. Available online: https://github.com/WindrunnerMax/MalwareDataset.
31. Sebastián, S., and Caballero, J. (2020, January 7–11). Avclass2: Massive Malware Tag Extraction from Av Labels. Proceedings of the ACSAC ‘20: Annual Computer Security Applications Conference, Austin, TX, USA.10.1145/3427228.3427261 ↗
32. Applying Nlp Techniques to Malware Detection in a Practical Environment10.1007/s10207-021-00553-8 ↗
33. Miyato, T., Dai, A.M., and Goodfellow, I. (2016). Adversarial Training Methods for Semi-Supervised Text Classification. arXiv.
34. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and Harnessing Adversarial Examples. arXiv.
35. LCDD: Detecting Business Process Drifts Based on Local Completeness