.png){kind=icon}
返回
Attention-Based API Locating for Malware Techniques
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2023.3330337.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
This paper presents APILI, an innovative approach to behavior-based malware analysis that utilizes deep learning to locate the API calls corresponding to discovered malware techniques in dynamic execution traces. APILI defines multiple attentions between API calls, resources, and techniques, incorporating MITRE ATT&CK framework, adversary tactics, techniques and procedures, through a neural network. We employ fine-tuned BERT for arguments/resources embedding, SVD for technique representation, and several design enhancements, including layer structure and noise addition, to improve the locating performance. To the best of our knowledge, this is the first attempt to locate low-level API calls that correspond to high-level malicious behaviors (that is, techniques). Our evaluation demonstrates that APILI outperforms other traditional and machine learning techniques in both technique discovery and API locating. These results indicate the promising performance of APILI, thus allowing it to reduce the analysis workload.
Keyword:
Causality tracking
dynamic analysis
malicious behavior discovery
malware analysis
MITRE ATT&CK
期刊
IF:
8
论文数:
5.4K
被引数:
2.7W
机构
引用论文
.png){kind=icon}
Compelexes de la ferrotetraphenylporphyrine avec des chlorocarbenes porteurs d'un groupement electroattracteur: Fer(II)(TPP)(CClA), A = CN ou COOC2H5四苯基四苯基铁卟啉化合物电子吸引子: Fer(II)(TPP)(CClA)，A = CN ou COOC2H5
PREAI
分享收藏
查看更多内容