The Application of Machine Learning to Study Malware Evolution

Abstract:

Malware evolves for the same reasons that ordinary software evolves. Like any other software product, the standard genetic operators selection, crossover and mutation are applied to evolve new malware. Recognizing and modeling how these malware evolve and are related is an important problem in the area of malware analysis. Grouping individual malware samples into malware families is not a new idea, and content-based comparison approaches have been proposed. Content-based approaches are hard to identify the real behavior of malware and it is inherently susceptible to inaccuracies due to polymorphic and metamorphic techniques. In this paper, we leveraged dynamic analysis approach to classify malware variants. The results demonstrate that our technique is able to recognize and group malware programs that behave similarly, achieving a better precision than previous approaches. The major advantage of our approach is that it can precisely tracks the sensitive information of malware behavior and is immune to obfuscation attempts. Our research is conducive to study the problem of malware classification, malware naming, and the phylogeny of malware.

• Periodical: Applied Mechanics and Materials (Volumes 530-531)
• Pages: 875-878
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.530-531.875
• Online since: February 2014
• Authors: Jin Rong Bai*, Shi Guang Mu, Guo Zhong Zou
• Keywords: Dynamic Analysis, Evolution, Machine Learning, Malware Variants

References

[1] C. Willems, T. Holz, and F. Freiling. Toward Automated Dynamic Malware Analysis Using CWSandbox. IEEE Security and Privacy, 5(2): 32-39 (2007).

DOI: 10.1109/msp.2007.45

[2] Anubis: Analyzing Unknown Binaries, on http: /anubis. seclab. tuwien. ac. at.

[3] A. Dinaburg, P. Royal, M. Sharif, et al. Ether: malware analysis via hardware virtualization extensions[C]/Proceedings of the 15th ACM conference on Computer and communications security. ACM, 51-62 (2008).

DOI: 10.1145/1455770.1455779

[4] L. Breiman. Random Forests. Machine learning, 45(1): 5-32 (2001).

[5] VXHeavens, on http: /vx. netlux. org.