Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification

By Mansour Ahmadi, Giorgio Giacinto, Dmitry Ulyanov, Stanislav Semenov, Mikhail Trofimov. Conference on Data and Application Security and Privacy, 2015

376 citations recorded by the source corpus.

Modern malware is designed with mutation characteristics, namely polymorphism and metamorphism, which causes an enormous growth in the number of variants of malware samples. Categorization of malware samples on the basis of their behaviors is essential for the computer security community, because they receive huge number of malware everyday, and the signature extraction process is usually based on malicious parts characterizing malware families. Microsoft released a malware classification challenge in 2015 with a huge dataset of near 0.5 terabytes of data, containing more than 20K malware samples. The analysis of this dataset inspired the development of a novel paradigm that is effective in categorizing malware variants into their actual family groups. This paradigm is presented and discussed in the present paper, where emphasis has been given to the phases related to the extraction, and selection of a set of novel features for the effective representation of malware samples. Features can be grouped according to different characteristics of malware behavior, and their fusion is performed according to a per-class weighting paradigm. The proposed method achieved a very high accuracy ($\approx$ 0.998) on the Microsoft Malware Challenge dataset.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/0e5f61c7dce101b95c62c0088a155e2773f111e7

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Len Hamey
2. Mahmood Yousefi-Azar
3. V. Varadharajan
4. U. Tupakula
5. Lorenzo Cavallaro
6. Mrigank Rochan
7. Farkhund Iqbal
8. Neil D. B. Bruce

In Computer Networks and Communications

1. V. Varadharajan
2. U. Tupakula
3. Lorenzo Cavallaro
4. Roberto Jordaney
5. Mrigank Rochan

In Signal Processing

1. Len Hamey
2. Mahmood Yousefi-Azar
3. V. Varadharajan
4. U. Tupakula
5. Lorenzo Cavallaro
6. Roberto Jordaney

Citations in the corpus

• Malware Classification with Deep Convolutional Neural Networks (2018, methodology): “[21] trained a classifier based on the XGBoost [22] technique.”
• Autoencoder-based feature learning for cyber security applications (2017, background): “In the literature, a wide range of feature sets have been used to identify anomaly intrusions and malware [5, 6, 7].”
• Transcend: Detecting Concept Drift in Malware Classification Models (2017, methodology): “This is not a critique against the work presented in [1, 2].”