A Biosequence-Based Approach to Software Characterization

Oehmen, Christopher S.; Peterson, Elena S.; Phillips, Aaron; Curtis, Darren

doi:10.1109/spw.2016.43

Cited by 1 publication

(3 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The average AUC value for family classification is 0.95 in ref. , but this work concerned benign families of software, used for computational chemistry, rather than malware. No effort is made by authors of benign software to disguise its purpose, as is the case for malware.…”

Section: Resultsmentioning

confidence: 99%

“…[12] then applies a support vector machine (SVM), a classifier that maps the data to a high dimensional space and uses a hyperplane to sep-arate the classes, to classify samples into families. [13] applies biosequence comparison techniques, designed for comparing genetic samples based on their genetic sequences, to compare nonmalicious software samples. Ref.…”

Section: Literature Overviewmentioning

confidence: 99%

“…The average AUC value for family classification is 0.95 in ref. [13], but this work concerned benign families of soft- 8 Dendrogram created using single-link clustering based on graph edit distances. 1|S G,H , D G,H ) was high for several values of H in the database from different families then it would be unclear to which family it belongs, but there would be a shortlist of possible families.…”

Section: Se As Al T Sea Sal T S Ta R S Y P O U N D S Ta R S Y P O U Nmentioning

confidence: 99%

See 2 more Smart Citations

APT malware static trace analysis through bigrams and graph edit distance

Bolton

Anderson‐Cook

2017

Statistical Analysis

View full text Add to dashboard Cite

Research and business organizations are vulnerable to attack by malware, particularly advanced persistent threat malware tailored for a specific target. Malware identification is made more difficult because samples can be subtly altered to avoid detection by methods that check for an identical match to known code. Different versions of an original piece of malware form a malware family. When new malicious software is identified, reverse engineers seek to identify its origin and purpose. Knowing whether new malware is from a known family or a previously unobserved family aids the efficiency of reverse engineers. This article presents a three‐stage method to classify new malware into a family by comparing its similarity to existing static traces, and assigning it to the most similar family. First, a fast filtering method creates a shortlist of samples with some similarity to the new malware, using a simple bigram comparison of the instructions. The second stage takes the call graph view of the shortlisted static traces and uses simulated annealing to estimate the graph edit distance, a measure of dissimilarity between graphs. Finally, a random forest classifier combines the previous two results to predict the family to which a new sample belongs. The paper also considers how to detect when malware is from a new family.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Literature Overviewmentioning

confidence: 99%