Hidost: a static machine-learning-based detector of malicious files

By Nedim Srndic, Pavel Laskov. 2016

107 citations recorded by the source corpus.

Malicious software, i.e., malware, has been a persistent threat in the information security landscape since the early days of personal computing. The recent targeted attacks extensively use non-executable malware as a stealthy attack vector. There exists a substantial body of previous work on the detection of non-executable malware, including static, dynamic, and combined methods. While static methods perform orders of magnitude faster, their applicability has been hitherto limited to specific file formats.This paper introduces Hidost, the first static machine-learning-based malware detection system designed to operate on multiple file formats. Extending a previously published, highly effective method, it combines the logical structure of files with their content for even better detection accuracy. Our system has been implemented and evaluated on two formats, PDF and SWF (Flash). Thanks to its modular design and general feature set, it is extensible to other formats whose logical structure is organized as a hierarchy. Evaluated in realistic experiments on timestamped datasets comprising 440,000 PDF and 40,000 SWF files collected during several months, Hidost outperformed all antivirus engines deployed by the website VirusTotal to detect the highest number of malicious PDF files and ranked among the best on SWF malware.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, methodology): “According to the results in [25, 26], both Gordon and Hidost performed well at detecting Flash malware.”
Feature Conservation in Adversarial Classifier Evasion: A Case Study (2017, methodology): “While it has since undergone a revision [32], the SL2013 was the version evaluated by the EvadeML tool, and the pair provides a natural evaluation framework for our purposes.”
Hardening Classifiers against Evasion: the Good, the Bad, and the Ugly (2017, methodology): “Therefore, once the conserved features of SL2013 are identified, we can simply apply the PDF structural path consolidation rules described in Srndic and Laskov [33] to transform these features to the corresponding conserved features for Hidost.”
Dimensionality Reduction as a Defense against Evasion Attacks on Machine Learning Classifiers (2017, background): “Machine learning is being used in a number of essential applications such as image recognition [1], natural language processing [2], spam detection [3], autonomous vehicles [4, 5] and even malware detection [6, 7].”
Enhancing robustness of machine learning systems via data transformations (2017, background): “Machine learning is being used in a number of essential applications such as image recognition [26], natural language processing [9], spam detection [10], autonomous vehicles [8], [33] and even malware detection [46], [11].”
Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware (2017, methodology): “PDF malware detectors based on such features include Slayer and Slayer NEO [1], [2], Hidost [3], and PDFRate [4], [5].”
Towards Adversarial Malware Detection (2018, methodology): “801 Šrndić and Laskov [85, 95] Hidost 2013 82.”