Behavioral malware clustering can be compromised by poisoning attacks.
problem Security of clustering algorithms for malware analysis.
method Investigated poisoning attacks on behavioral malware clustering.
result Behavioral malware clustering is vulnerable to poisoning attacks.
MatchGNet detects malware by learning program behavior graphs.
problem Malware evasion through obfuscation and high false positives in traditional detection methods.
method Heterogeneous Graph Matching Network model that learns graph representation and similarity metrics.
result MatchGNet reduces false positives by 50% while maintaining zero false negatives.
This paper presents a novel deep learning based method for automatic malware signature generation and classification. The method uses a deep belief network (DBN), implemented with a deep stack of denoising autoencoders, generating an invariant compact representation of the malware behavior. While conventional signature…
Paper aims to bridge semantic gap between ML and InfoSec by labeling malware datasets with behavioral features.
problem Semantic gap between ML and InfoSec communities hinders ML's impact in InfoSec.
method Surveyed existing malware datasets and features, labeled with behavioral features using threat reports.
result Behavioral labeling alters analysis from intent to executable behavior, bridging semantic gap.
Malware authors have always been at an advantage of being able to adversarially test and augment their malicious code, before deploying the payload, using anti-malware products at their disposal. The anti-malware developers and threat experts, on the other hand, do not have such a privilege of tuning anti-malware produ…
Paper proposes a new model using Capsule Networks to classify malware types.
problem Classifying malware types with varying behaviors.
method Ensemble Capsule Network model using bootstrap aggregating.
result Improved accuracy in classifying malware types.
Research designs an AI system to classify malware under adversarial conditions.
problem Adversarial attacks on malware classification algorithms.
method Machine learning-based intelligent systems approach.
result Robust malware classification model under adversarial conditions.
Deep learning models misclassify malware with added benign features.
problem Detecting malware with deep learning when it's mixed with benign code.
method Trained a deep neural network classifier using benign and malware features. Demonstrated the impact of adding benign features to malware. Used data augmentation to improve classifier robustness.
result Adding benign features to malware significantly increases false negatives.
Transformer models improve malware classification, especially for imbalanced datasets.
problem Imbalanced multiclass malware classification.
method Bagging-based random transformer forest (RTF) ensemble of pre-trained transformer models (BERT or CANINE).
result Ensemble of pre-trained transformer models achieves state-of-the-art F1-score of 0.6149 on a benchmark dataset.
Paper proposes a hierarchical approach to malware detection in cloud environments.
problem Malware threat in cloud computing environments.
method Machine learning on graphs, hypergraphs, and natural language for malware detection and analysis.
result Federated learning for malware detection in multicloud environments.
This paper explores adversarial examples in malware detection.
problem Malware detectors are vulnerable to adversarial interference.
method Training an existing model on a production-scale dataset to test adversarial attacks.
result Some previous attacks are less effective than initially reported.
New method tags malware for better understanding and identification.
problem Lack of detailed descriptions and relationships between malware samples.
method Deep learning model generates human-interpretable descriptions and similarity index.
result Correctly identifies more than 95% of eleven tag descriptions with a low false positive rate.
It is needed to ensure the integrity of systems that process sensitive information and control many aspects of everyday life. We examine the use of machine learning algorithms to detect malware using the system calls generated by executables-alleviating attempts at obfuscation as the behavior is monitored rather than t…
Deep neural networks classify nation-state malware with high accuracy.
problem Classifying and attributing advanced persistent threats (APT) from nation-states.
method Used deep neural networks to analyze malware behavior in a sandbox, learning high-level feature abstractions.
result Achieved 98.6% accuracy in classifying 1000 Chinese and Russian APTs.
A growing number of threats to Android phones creates challenges for malware detection. Manually labeling the samples into benign or different malicious families requires tremendous human efforts, while it is comparably easy and cheap to obtain a large amount of unlabeled APKs from various sources. Moreover, the fast-p…
Effective and efficient mitigation of malware is a long-time endeavor in the information security community. The development of an anti-malware system that can counteract an unknown malware is a prolific activity that may benefit several sectors. We envision an intelligent anti-malware system that utilizes the power of…
PAD offers a principled approach to malware detection against evasion attacks.
problem Machine Learning techniques for malware detection are vulnerable to evasion attacks.
method PAD proposes a new adversarial training framework with convergence guarantees for robust optimization.
result PAD significantly outperforms state-of-the-art defenses and can harden ML-based malware detection against 27 evasion attacks.
I-MAD detects malware with high accuracy and interpretable results.
problem Detecting new malware samples and providing interpretable results.
method Galaxy Transformer network and interpretable feed-forward neural network.
result Significantly outperforms existing static malware detection models.
Malware is constantly adapting in order to avoid detection. Model based malware detectors, such as SVM and neural networks, are vulnerable to so-called adversarial examples which are modest changes to detectable malware that allows the resulting malware to evade detection. Continuous-valued methods that are robust to a…
This paper analyzes CNNs for malware detection in cloud IaaS.
problem Malware vulnerability in cloud IaaS environments.
method Analysis of Convolutional Neural Networks (CNNs) for online malware detection using process-level performance metrics.
result State-of-the-art DenseNets and ResNets effectively detect malware in online cloud systems.
New method detects malware through obfuscation using adversarial risk analysis.
problem Insufficient malware detection in obfuscated binaries.
method Hybrid framework and adversarial risk analysis.
result Improved detection of malware through obfuscation.
Framework enhances DNNs against malware attacks.
problem Adversarial malware detection in DNNs.
method Hashing Transformation Deep Neural Networks (HashTran-DNN) with DAE regularizer.
result HashTran-DNN effectively defends against all four known attacks.
Study malware evasion attacks and defenses using ML classifiers.
problem Adversarial examples can mislead ML-based malware detectors.
method Investigated white-box and grey-box evasion attacks; compared defense approaches.
result Proposed a framework for grey-box and black-box attacks.
Survey on deep learning for malware classification, including unknown threats.
problem Classifying and recognizing unknown malware variants.
method Review of deep learning techniques and OSR solutions.
result Deep learning can effectively classify known malware and recognize unknown threats.
Study on adversarial examples and defenses for malware classification.
problem Vulnerability of neural networks to adversarial examples in malware classification.
method Analysis of different approaches for crafting adversarial examples and defense techniques in malware domain.
result Comparison of effectiveness of different approaches on multiple datasets.
Deep transfer learning improves malware classification speed and accuracy.
problem Static malware classification accuracy and speed.
method Transfer learning from computer vision to static malware detection.
result Our method outperforms classical machine learning methods in accuracy, false positive rate, true positive rate, and F1 score.
apk2vec builds profiles of Android apps using multiple views, outperforming existing methods.
problem Building comprehensive behavior profiles of Android apps for better analytics.
method Semi-supervised multi-view representation learning combining RL and feature hashing.
result apk2vec's profiles significantly outperform state-of-the-art techniques in app analytics tasks.
Study compares Android malware and benign apps using permissions.
problem Classify Android malware from benign apps.
method Used machine learning techniques like decision trees, random forests, SVM, etc.
result Permissions are a strong feature for malware detection.
Project classifies malware using a multi-input LSTM model.
problem Classifying malware with high accuracy and handling class imbalance.
method Supervised multi-class LSTM model trained on annotated malware files.
result Multi-input model using both text and hexadecimal inputs outperformed single formats.
Deep learning improves Android malware detection.
problem Detecting and preventing Android malware.
method Review of static, dynamic, and hybrid deep learning approaches.
result Identifies strengths and weaknesses of deep learning methods.
Proposes RSST for selecting relevant Android malware attributes.
problem Deriving relevant attributes for analyzing Android malware.
method Rough Set and Statistical Test-based feature selection.
result RSST derived system calls outperform other feature selectors in accuracy and FPR.
New adversarial training enhances malware detectors against various attacks.
problem Vulnerability of malware detectors to evasion attacks.
method Proposes a mixture of attacks and adversarial training to improve deep neural networks.
result Significantly enhances robustness of deep neural networks against a wide range of attacks.
GMM-HMMs improve malware classification compared to discrete HMMs.
problem Improving malware classification accuracy using GMM-HMM models.
method Used GMM-HMM models for opcode and entropy-based features comparison with discrete HMMs.
result GMM-HMMs generally improve significantly on entropy-based features classification results.
A new method clusters malware data more effectively.
problem Difficult clustering of drive-by-download malware data.
method Iterative data rescaling method to enhance cluster separation.
result Improved separation between malware clusters, higher silhouette width.
DL-Droid detects Android malware using deep learning and real devices.
problem Sophisticated Android malware detection challenges traditional methods.
method Deep learning system with stateful input generation on real devices.
result DL-Droid achieves up to 99.6% detection rate with dynamic + static features.
Two novel dataset optimization strategies improve malware traffic detection accuracy.
problem Redundant and irrelevant information in network traffic datasets increases computational cost and noise.
method Feature selection and dimensional reduction techniques using mutual information and autoencoders.
result Optimized dataset leads to improved accuracy of Multi Layer Perceptron for malware detection.
Paper uses dynamic analysis to detect malware with PHMMs.
problem Malware detection using static and dynamic analysis techniques.
method Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs) trained on API call sequences.
result PHMMs outperform HMMs in malware detection.
HGConv uses HRR to efficiently detect malware, outperforming existing methods.
problem Efficiently detecting malware with long sequences.
method Holographic Global Convolutional Networks (HGConv) utilizing Holographic Reduced Representations (HRR).
result Achieved state-of-the-art results on malware benchmarks.
Detects malware-infected clients and malicious domains using transfer learning.
problem Detecting malware-infected computers and malicious web domains from encrypted HTTPS traffic.
method Transfer learning with sluice networks to bootstrap each other's detection models.
result Outperforms known reference models and detects previously unknown malware and domains.
Survey of machine learning methods for Windows malware classification.
problem Difficulties in malware classification through data collection, labeling, feature creation, and selection.
method Review of current methods and challenges in malware classification.
result Discussion of constraints and unaddressed problems for machine learning in cybersecurity.
This paper proposes a generic classification system designed to detect security threats based on the behavior of malware samples. The system relies on statistical features computed from proxy log fields to train detectors using a database of malware samples. The behavior detectors serve as basic reusable building block…
Improved malware detection by adding auxiliary loss terms to a neural network.
problem Malware detection accuracy with a single label.
method Fit deep neural networks to multiple auxiliary prediction targets derived from metadata.
result Significant improvement in detection performance, reducing false negatives by 42.6% at a low false positive rate.
In recent years numerous advanced malware, aka advanced persistent threats (APT) are allegedly developed by nation-states. The task of attributing an APT to a specific nation-state is extremely challenging for several reasons. Each nation-state has usually more than a single cyber unit that develops such advanced malwa…
Multi-scanner Antivirus systems provide insightful information on the nature of a suspect application; however there is often a lack of consensus and consistency between different Anti-Virus engines. In this article, we analyze more than 250 thousand malware signatures generated by 61 different Anti-Virus engines after…
Paper develops malware detection methods using Hamming distance.
problem Detecting and preventing spread of Android malware.
method Four detection methods using Hamming distance for similarity.
result Accuracy rates of proposed algorithms are more than 90%.
Many efforts have been made to use various forms of domain knowledge in malware detection. Currently there exist two common approaches to malware detection without domain knowledge, namely byte n-grams and strings. In this work we explore the feasibility of applying neural networks to malware detection and feature lear…
Study evaluates predictive uncertainty in malware detection.
problem Detecting dataset shift and adversarial examples in malware detection.
method Re-designed and built 24 Android malware detectors, quantified their uncertainties with nine metrics.
result Predictive uncertainty helps reliable malware detection but not adversarial evasion attacks.
Machine-learning models have been recently used for detecting malicious Android applications, reporting impressive performances on benchmark datasets, even when trained only on features statically extracted from the application, such as system calls and permissions. However, recent findings have highlighted the fragili…