.png){kind=icon}
Return
MALIGN: Explainable static raw-byte based malware family classification using sequence alignment
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.103714.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
For a long time, malware classification and analysis have been an arms-race between antivirus systems and malware authors. Though static analysis is vulnerable to evasion techniques, it is still popular as the first line of defense in antivirus systems. But most of the static analyzers failed to gain the trust of practitioners due to their black-box nature. We propose MALIGN, a novel static malware family classification approach inspired by genome sequence alignment that can not only classify malware families but can also provide explanations for its decision. MALIGN encodes raw bytes using nucleotides and adopts genome sequence alignment approaches to create a signature of a malware family based on the conserved code segments in that family, without any human labor or expertise. We evaluate MALIGN on two malware datasets, and it outperforms other state-of-the-art machine learning-based malware classifiers (by 4.49%-0.07%), especially on small datasets (by 19.48%-1.2%). Furthermore, we explain the generated signatures by MALIGN on different malware families illustrating the kinds of insights it can provide to analysts, and show its efficacy as an analysis tool. Additionally, we evaluate its theoretical and empirical robustness against some common attacks. In this paper, we approach static malware analysis from a unique perspective, aiming to strike a delicate balance among performance, interpretability, and robustness.
Keywords:
Malware
Sequence alignment
Explainability
Machine learning
Adversarial
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers
ShareSaveShareSaveCharacterization of polymer matrix and low melting point solder for anisotropic conductive film
PREAI
ShareSave
ShareSaveShareSaveShareSaveShareSaveScalable multiple whole-genome alignment and locally collinear block construction with SibeliaZ.png)
NATURE COMMUNICATIONS
OAAI
NATURE COMMUNICATIONSIF15.7
OAAIShareSaveShareSave
View more