Automatic analysis of malware behavior using machine learning

By Konrad Rieck, Philipp Trinius, Carsten Willems, Thorsten Holz. 2011

764 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Poisoning behavioral malware clustering (2014, methodology): “For our experiments and evaluation we make use of two different datasets: ﬁrst, the data that was originally considered by Rieck et al. in [28], and second, a dataset consisting of more recent malware samples collected in 2013.”
Evading Classifiers by Morphing in the Dark (2017, background): “Numerous innovative applications of machine learning in security contexts, especially for detection of security violations, have been discussed in the literature [19, 22, 28].”
Research Priorities for Robust and Beneficial Artificial Intelligence (2015, methodology): “These techniques could be applied to the detection of intrusions (Lane 2000), analyzing malware (Rieck et al. 2011), or detecting potential exploits in other programs through code analysis (Brun and Ernst 2004).”
Poisoning Complete-Linkage Hierarchical Clustering (2014, background): “The reason is that single- and complete-linkage hierarchical clustering algorithms are among the most used ones for the purpose of malware detection and classification [3, 4].”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, methodology): “Automatic analysis of malware behavior using machine learning [19] Rieck, 2011 Clustering CWSandbox was used to extract system calls from 3,133 malware samples.”
Malware Analysis and Classification: A Survey (2014, methodology): “[39] proposed a framework for automatic analysis of malware behavior using machine learning.”
Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, neutral): “Successive work [14], demonstrated the relevance of poisoning attacks in computer security by attacking the Malheur malware behavioral clustering tool [40].”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, neutral): “In [32, 33], Rieck et al.”
Summoning Demons: The Pursuit of Exploitable Bugs in Machine Learning (2017, methodology): “We utilize this technique to discover attacks against OpenCV [4] and Malheur [31], two open source ML implementations.”
Analysis of Machine learning Techniques Used in Behavior-Based Malware Detection (2010, methodology): “Rieck et al. [ 4 ] propose a framework for automatic analysis of malware behavior using machine learning.”
AVclass: A Tool for Massive Malware Labeling (2016, methodology): “As shown in Appendix Table 10, when comparing F1 measure, tools like Malheur [29] (F1= 95%), BitShred [13] (F1=93.2%), and FIRMA [26] (F1=98.8”
Practical Attacks Against Graph-based Clustering (2017, neutral): “Finally, an attacker has full knowledge of the features, machine learning algorithms, and hyperparameters used in both the unsupervised and supervised phases of the system under attack, as these are often published [8, 9, 20, 29, 41, 45, 48].”
Pattern Recognition Systems under Attack: Design Issues and Research Challenges (2014, background): “We first review previous work and report examples of how a complex system may be evaded either by leveraging on trivial vulnerabilities of its untrained components, e.g., parsing errors in the pre-processing steps, or by exploiting more subtle vulnerabilities of learning algorithms.”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, background): “Furthermore, diﬀerent approaches have their respective strengths and limitations that often depend on the characteristics of input data, such as data distribution, pre-processing procedures, anti-analysis techniques used by malware programs, etc.”
Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection (2016, methodology): “This contrasts with some solutions proposed in where no feature selection algorithm is proposed [20], [28].”
Adversarial Examples for Malware Detection (2017, methodology): “Classification with machine learning is also applied to automate the detection of unwanted software like malware [29], or to automate source code analysis [33].”