.png){kind=icon}
返回
MALIGN: Explainable static raw-byte based malware family classification using sequence alignment
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.103714.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
For a long time, malware classification and analysis have been an arms-race between antivirus systems and malware authors. Though static analysis is vulnerable to evasion techniques, it is still popular as the first line of defense in antivirus systems. But most of the static analyzers failed to gain the trust of practitioners due to their black-box nature. We propose MALIGN, a novel static malware family classification approach inspired by genome sequence alignment that can not only classify malware families but can also provide explanations for its decision. MALIGN encodes raw bytes using nucleotides and adopts genome sequence alignment approaches to create a signature of a malware family based on the conserved code segments in that family, without any human labor or expertise. We evaluate MALIGN on two malware datasets, and it outperforms other state-of-the-art machine learning-based malware classifiers (by 4.49%-0.07%), especially on small datasets (by 19.48%-1.2%). Furthermore, we explain the generated signatures by MALIGN on different malware families illustrating the kinds of insights it can provide to analysts, and show its efficacy as an analysis tool. Additionally, we evaluate its theoretical and empirical robustness against some common attacks. In this paper, we approach static malware analysis from a unique perspective, aiming to strike a delicate balance among performance, interpretability, and robustness.
Keyword:
Malware
Sequence alignment
Explainability
Machine learning
Adversarial
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
Improvement of malware detection and classification using API call sequence alignment and visualization使用API调用序列比对和可视化改进恶意软件检测和分类
PREAI
分享收藏Characterization of polymer matrix and low melting point solder for anisotropic conductive film各向异性导电膜用聚合物基体及低熔点焊料的表征
PREAI
分享收藏
Mauve: Multiple alignment of conserved genomic sequence with rearrangementsMauve: 具有重排的保守基因组序列的多重比对.png)
GENOME RESEARCH
OAAI
GENOME RESEARCHIF5.5
OAAI分享收藏Minimal contrast frequent pattern mining for malware detection用于恶意软件检测的最小对比度频繁模式挖掘COMPUTERS & SECURITY
COMPUTERS & SECURITYIF5.4
PREAI
分享收藏分享收藏Scalable multiple whole-genome alignment and locally collinear block construction with SibeliaZNATURE COMMUNICATIONSOAAI
NATURE COMMUNICATIONSIF15.7
OAAI分享收藏分享收藏
查看更多内容