Improving malware classification: Bridging the static/dynamic gap

Blake Anderson, Curtis Storlie, Terran Lane

Research output: Chapter in Book/Report/Conference proceedingConference contribution

61 Scopus citations

Abstract

Malware classification systems have typically used some machine learning algorithm in conjunction with either static or dynamic features collected from the binary. Recently, more advanced malware has introduced mechanisms to avoid detection in these views by using obfuscation techniques to avoid static detection and execution-stalling techniques to avoid dynamic detection. In this paper we construct a classification framework that is able to incorporate both static and dynamic views into a unified framework in the hopes that, while a malicious executable can disguise itself in some views, disguising itself in every view while maintaining malicious intent will prove to be substantially more difficult. Our method uses kernels to place a similarity metric on each distinct view and then employs multiple kernel learning to find a weighted combination of the data sources which yields the best classification accuracy in a support vector machine classifier. Our approach opens up new avenues of malware research which will allow the research community to elegantly look at multiple facets of malware simultaneously, and which can easily be extended to integrate any new data sources that may become popular in the future.

Original languageEnglish (US)
Title of host publicationAISec'12 - Proceedings of the ACM Workshop on Security and Artificial Intelligence
Pages3-14
Number of pages12
DOIs
StatePublished - Nov 27 2012
Event5th ACM Workshop on Artificial Intelligence and Security, AISec 2012 - Raleigh, NC, United States
Duration: Oct 19 2012Oct 19 2012

Publication series

NameProceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)1543-7221

Other

Other5th ACM Workshop on Artificial Intelligence and Security, AISec 2012
CountryUnited States
CityRaleigh, NC
Period10/19/1210/19/12

Keywords

  • Computer Security
  • Machine Learning
  • Malware
  • Multiple Kernel Learning

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Improving malware classification: Bridging the static/dynamic gap'. Together they form a unique fingerprint.

  • Cite this

    Anderson, B., Storlie, C., & Lane, T. (2012). Improving malware classification: Bridging the static/dynamic gap. In AISec'12 - Proceedings of the ACM Workshop on Security and Artificial Intelligence (pp. 3-14). (Proceedings of the ACM Conference on Computer and Communications Security). https://doi.org/10.1145/2381896.2381900