2012 IEEE Symposium on Security and Privacy Prudent Practices for Designing Malware Experiments: Status Quo and Outlook

Citations in the corpus

• Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, methodology): “d for our experiments is composed of 5828 les, 1593 of which are malicious (an amount comparable to previous works [33, 25, 26]) and 4235 are benign (we chose this amount to work on balanced datasets [64]). All malicious les, as well as part the benign ones, were retrieved from the VirusTotal servic”
• Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables (2018, methodology): “We also plan to repeat the assessment of this paper on a larger dataset, more representative of recent malware trends (as advocated by Rossow et al. [19]).”
• DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket (2014, background): “Another important aspect that should be considered when testing the detection performance of a method is the balance of malware families in the dataset [32].”
• Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection (2016, methodology): “The construction of the dataset, and the use of the sandbox, have been done following the best practices suggested in [29], and is described in the following.”
• Robust Intelligent Malware Detection Using Deep Learning (2019, background): “The complexities and various issues of Dynamic analysis are discussed in detail by [10].”
• An empirical comparison of botnet detection methods (2014, background): “…comparisons are: the absence of proper documentation of the methods (Tavallaee et al., 2010), the lack of a common, labeled and good botnet dataset (Rossow et al., 2012), the lack of a comparison methodology (Aviv et al., 2011) and the lack of a suitable error metric (Salgarelli et al., 2007).”
• TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, background): “To be precise, Rossow et al. [44] evaluate the percentage of objects—in previously adopted datasets—that are “incorrect” (e.g., goodware labeled as malware, malfunctioning malware), but without evaluating impact on classifier performance.”
• Detection of Intrusions and Malware, and Vulnerability Assessment (2013, background): “Issues related to imbalanced malware family datasets have also been reported in [29].”
• Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification (2015, background): “A recent survey on 36 research papers on dynamic analysis techniques [38] pointed out that the common shortcomings of dynamic analysis techniques are the problematic and somewhat obscure assumptions regarding the use of execution-driven datasets, and the lack of details and motivation on the…”
• ShieldFS: a self-healing, ransomware-aware filesystem (2016, methodology): “Following the best practices for malware experiments suggested by [12], (1) we let the malware executables run for 90 minutes, (2) we allowed the samples to communicate with their control servers, and (3) denied any potentially harmful traffic (e.g., spam) during the experiments.”
• Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks (2015, methodology): “We performed all malware execution experiments according to common scientific guidelines [33] inside a Cuckoo Sandbox [14] running Windows XP SP3 32bit, with a controlled access to the Internet via NAT.”
• Malware Detection by Eating a Whole EXE (2017, background): “Even when malware does not exhibit this behavior, the analysis environment may not reflect the target environment of the malware, creating a discrepancy between the training data collected and real life environments (Rossow et al. 2012).”