Video Converter
Audio Converter
Image Converter
PDF Converter
File Compressor
improving malware classification bridging the static

Improving Malware Classification: Bridging the Static/Dynamic Gap - PowerPoint PPT Presentation

Jan 05, 2023 •32 likes •192 views

Improving Malware Classification: Bridging the Static/Dynamic Gap Authors: Blake Anderson, Curtis Storlie, Terran Lane Vinit Singh 18 th April 2017 CISC850 Cyber Analytics CISC850 Cyber Analytics INTRODUCTION Why is there a need for

  1. Improving Malware Classification: Bridging the Static/Dynamic Gap Authors: Blake Anderson, Curtis Storlie, Terran Lane Vinit Singh 18 th April 2017 CISC850 Cyber Analytics

  2. CISC850 Cyber Analytics INTRODUCTION • Why is there a need for machine learning in malware detection ? • The need for different type of data sources and how to combine them. • Unified framework by using a support vector machine using multiple kernel learning.

  3. CISC850 Cyber Analytics DATA SOURCES • STATIC SOURCES: Binary, Disassembled Binary, Control Flow Graph • DYNAMIC SOURCES: Dynamic Instruction Traces (DIT) , Dynamic System Call Traces (DST) • MISCELLANEOUS FILE INFORMATION: Entropy, Packers, Instructions in file, vertices and edges in CFG

  4. CISC850 Cyber Analytics METHOD STEP 1: DATA REPRESENTATION • Markov chain representation for raw binary, disassembled binary, DIT and DST • Standard representation for Control Flow Graph • The miscellaneous file information is represented as a simple feature vector of length seven

  5. STEP 2: KERNELS • The Kernel Trick • Exponential Kernel: x i : Features of the file information / transition probability of Markov chain • Graphlet Kernel: G: Graph , k : number of nodes of subgraph equal to k D G : Normalized probability vector = fg / # of all graphlets of size k fg = feature vector consisting number of times unique subgraph of size k occurs

  6. Heatmaps for Individual Kernels

  7. STEP 3: MULTIPLE KERNEL LEARNING • Optimization problem for classical kernel learning: Subject to constraint: Thus the Decision function is : • But for multiple kernel learning we need to estimate β k

  8. Heatmap of Combined Kernel

  9. RESULTS • Criteria 1 : Accuracy: Accuracy is calculated using 10-fold cross-validation.

  10. • Criteria 2: ROC Curves / AUC Values

  11. • Criteria 3: Speed to classify new instances

  12. • Criteria 4: Testing on a Large Malware Sample Accuracy on validation set consisting of 20k samples

  13. OBSERVATIONS • There were a total of 19 false positives and false negatives that were found out of 1556 instances of the original dataset. • Use of only static analysis doesn’t work well when the training instances have been packed.

  14. LIMITATIONS AND DRAWBACKS • Selecting an appropriate value of n for n-gram analysis • Time to collect dynamic system traces will be too resource intensive on a normal system • Choosing optimal instruction call categories • Intel Pin isn’t transparent while tracing the program to collect instructions

  15. RELATED WORK • Use of single data sources • Use of static data sources combined with ensemble learning • Result Fusion Model • Identifying packed and hidden code

  16. CONCLUSION • Not restricting malware classification to a single data source improves classification accuracy. • In a resource constrained environment combined static analysis can result in high accuracy and low number of false positives. • Static analysis is not an optimal solution when instances have been packed or have an high entropy.

Recommend

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Malware Obfuscation Techniques: Packing November 18, 2014 Malware and packing Not packed (20%)

Malware Obfuscation Techniques: Packing November 18, 2014 Malware and packing Not packed (20%)

Malware Obfuscation Techniques: Packing November 18, 2014 Malware and packing Not packed (20%) 80% of new malware are packed with various packers Malware Obfuscation Techniques: Packing 2 Malware and packing Not packed (20%) 80%

991 views • 51 slides
Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd Paul Rascagnres from Malware.lu Linux malware presentation Plan - Presentation - Darkleech/Chapro - Cdorked - Wirenet

430 views • 31 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

789 views • 16 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

401 views • 27 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

511 views • 27 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

826 views • 44 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

548 views • 42 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

574 views • 22 slides
Static and Method Overloading static One per class, not per object static variables

Static and Method Overloading static One per class, not per object static variables

Static and Method Overloading static One per class, not per object static variables all instances of the class share the same static variable example: serial/VIN number for Car static methods invoked through class

325 views • 7 slides
What role for static analysis in malware detection? Laurence Tratt http://tratt.net/laurie/

What role for static analysis in malware detection? Laurence Tratt http://tratt.net/laurie/

What role for static analysis in malware detection? Laurence Tratt http://tratt.net/laurie/ Middlesex University With thanks to David Clark 2011/4/6 L. Tratt http://tratt.net/laurie/ Static analysis and malware 2011/4/6 1 / 21 Overview

1.3k views • 53 slides
Static and dynamic verification Static and dynamic V&V Software inspections Concerned

Static and dynamic verification Static and dynamic V&V Software inspections Concerned

1 2 Static and dynamic verification Static and dynamic V&V Software inspections Concerned with analysis of the static system Static representation to discover problems (static verification verification) May be supplement by

107 views • 6 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.29k views • 28 slides
StealthWare Social Engineering Malware Running malware for Social Engineering and Covert

StealthWare Social Engineering Malware Running malware for Social Engineering and Covert

StealthWare Social Engineering Malware Running malware for Social Engineering and Covert Operations By: Joey Dreijer StealthWare Social Engineering Malware Social Engineering and Covert Operations Introduction Research Security

403 views • 21 slides
Port Host Communities Revitalization Fund (PHCRF) PUBLIC INPUT SESSION: JUNE 3, 2019 FY 2020

Port Host Communities Revitalization Fund (PHCRF) PUBLIC INPUT SESSION: JUNE 3, 2019 FY 2020

Port Host Communities Revitalization Fund (PHCRF) PUBLIC INPUT SESSION: JUNE 3, 2019 FY 2020 Budget Language $ 1,000,000 THE SECOND YEAR FROM THE GENERAL FUND IS DESIGNATED FOR REMOVING, RENOVATING, OR MODERNIZING PORT-RELATED BUILDINGS AND

626 views • 23 slides
Case Management Best P r actice Case Management regulations. Case Study. Community

Case Management Best P r actice Case Management regulations. Case Study. Community

Case Management Best P r actice Case Management regulations. Case Study. Community Links Wollondilly and the Case Work Team LEGISLATION AGENCY STANDARDS PROFESSIONAL STANDARDS CMSA STANDARDS STRENGTH BASED APPROACH PERSON

479 views • 25 slides
Best Practices for Addressing N.I.M.B.Y. (Not In My Backyard) KATIE JO BREIDENBACH WOODING

Best Practices for Addressing N.I.M.B.Y. (Not In My Backyard) KATIE JO BREIDENBACH WOODING

Best Practices for Addressing N.I.M.B.Y. (Not In My Backyard) KATIE JO BREIDENBACH WOODING EDUCATION AND TRAINING COORDINATOR, OHIO RECOVERY HOUSING A Reminder. . . This presentation and Q&A does not serve as legal If you are concerned

406 views • 27 slides
Presentation to Audit and Governance Committee 24 th June 2010 Final Accounts features &

Presentation to Audit and Governance Committee 24 th June 2010 Final Accounts features &

www.nwleics.gov.uk Presentation to Audit and Governance Committee 24 th June 2010 Final Accounts features & facts www.nwleics.gov.uk Final Accounts background Accounts and audit regulations 2003 Local Government Act 2003

141 views • 9 slides
Multiple-UUV Approach for Enhancing Connectivity in Underwater Ad-hoc Sensor Networks Winston

Multiple-UUV Approach for Enhancing Connectivity in Underwater Ad-hoc Sensor Networks Winston

Multiple-UUV Approach for Enhancing Connectivity in Underwater Ad-hoc Sensor Networks Winston Seah Institute for Infocomm Research, Singapore winston@i2r.a-star.edu.sg http://www1.i2r.a-star.edu.sg/~winston Outline Introduction &

440 views • 24 slides
Bridge over troubled water Spanning the energy-efficiency gap Author: Agneta Persson, WSP

Bridge over troubled water Spanning the energy-efficiency gap Author: Agneta Persson, WSP

Bridge over troubled water Spanning the energy-efficiency gap Author: Agneta Persson, WSP Environmental agneta.persson@wspgroup.se Co-authors: Anders Gransson, PROFU & Erik Gudbjerg, LokalEnergi A/S

272 views • 14 slides
at Microwave Frequencies University of British Columbia Okanagan Campus Kelowna, British

at Microwave Frequencies University of British Columbia Okanagan Campus Kelowna, British

Loop-Gap Resonators: EM Material Properties Measured at Microwave Frequencies University of British Columbia Okanagan Campus Kelowna, British Columbia, Canada October 8, 2019 http://physics.ok.ubc.ca/welcome.html Loop-Gap Resonator (LGR)

498 views • 15 slides
Understanding Developing and Utilizing ETEPs PRESENTED BY: Josh Simmons Principal Consultant /

Understanding Developing and Utilizing ETEPs PRESENTED BY: Josh Simmons Principal Consultant /

Understanding Developing and Utilizing ETEPs PRESENTED BY: Josh Simmons Principal Consultant / Attorney / Collaborative Strategist www.ProsperSustainably.com & Rob Roy Environmental Director La Jolla Band of Luiseno Indians October 27,

619 views • 38 slides

More recommend

Explore More Topics

Stay informed with curated content and fresh updates.

animals pets art culture automotive transportation business finance computer internet construction architecture education-career electronics communication

Logo Sambuz

Unleash a World of Digital Possibilities—Browse, Share, and Explore Content Without Boundaries

Useful Links

About Us Privacy Services FAQ's Contact

Newsletter

Stay Informed & Inspired—Subscribe for the Latest Updates, Tips, and Exclusive Content Directly to Your Inbox.

Mail Us

mail@sambuz.com

2026 SAMBUZ, All right reserved.