Malware classification with recurrent networks

Pascanu, Razvan; Stokes, Jack W.; Sanossian, Hermineh Y. Y.; Marinescu, Mady; Thomas, Anil

doi:10.1109/icassp.2015.7178304

Cited by 310 publications

(179 citation statements)

References 12 publications

Supporting

Mentioning

177

Contrasting

Unclassified

Order By: Relevance

“…In contrast to these methods our approach works directly with raw text with no preprocessing beyond tokenization using known field delimiters. Others have incorporated LSTM networks to preprocess sequences of process API calls as components to malware detection systems [14] trained on labeled malware examples.…”

Section: Related Workmentioning

confidence: 99%

Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

Brown

Tuor

Hutchinson

et al. 2018

Proceedings of the First Workshop on Machine Learning for Computing Systems

150

View full text Add to dashboard Cite

Deep learning has recently demonstrated state-of-the art performance on key tasks related to the maintenance of computer systems, such as intrusion detection, denial of service attack detection, hardware and software system failures, and malware detection. In these contexts, model interpretability is vital for administrator and analyst to trust and act on the automated analysis of machine learning models. Deep learning methods have been criticized as black box oracles which allow limited insight into decision factors. In this work we seek to "bridge the gap" between the impressive performance of deep learning models and the need for interpretable model introspection. To this end we present recurrent neural network (RNN) language models augmented with attention for anomaly detection in system logs. Our methods are generally applicable to any computer system and logging source. By incorporating attention variants into our RNN language models we create opportunities for model introspection and analysis without sacrificing state-of-the art performance. We demonstrate model performance and illustrate model interpretability on an intrusion detection task using the Los Alamos National Laboratory (LANL) cyber security dataset, reporting upward of 0.99 area under the receiver operator characteristic curve despite being trained only on a single day's worth of data.A. Brown et al.detection, and 2) we illustrate how model introspection in these systems is made possible by the attention mechanisms.

show abstract

Section: Related Workmentioning

confidence: 99%

Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

Brown

Tuor

Hutchinson

et al. 2018

Proceedings of the First Workshop on Machine Learning for Computing Systems

150

View full text Add to dashboard Cite

show abstract

“…Some drawbacks of conventional supervised learning methods are that a lot effort and domain expertise is required in creating and identifying important features [18], high false positive rates from such techniques, and their assumptions are too simple (naive) to provide higher conceptual features [19]. Due to these shortcomings, Deep Learning based techniques are gaining a lot of traction in malware detection.…”

Section: Related Work On Malware Detectionmentioning

confidence: 99%

An investigation of a deep learning based malware detection system

Sewak

Sahay

Rathore

2018

Proceedings of the 13th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

We investigate a Deep Learning based system for malware detection. In the investigation, we experiment with different combination of Deep Learning architectures including Auto-Encoders, and Deep Neural Networks with varying layers over Malicia malware dataset on which earlier studies have obtained an accuracy of (98%) with an acceptable False Positive Rates (1.07%). But these results were done using extensive man-made custom domain features and investing corresponding feature engineering and design efforts. In our proposed approach, besides improving the previous best results (99.21% accuracy and an False Positive Rate of 0.19%) indicates that Deep Learning based systems could deliver an effective defense against malware. Since it is good in automatically extracting higher conceptual features from the data, Deep Learning based systems could provide an effective, general and scalable mechanism for detection of existing and unknown malware.

show abstract

“…Malware Classification. Pascanu et al [24] model malware API calls as a sequence and use a recurrent model trained to predict next API call, and use the hidden state of the model (that encodes the history of past events) as the fixed-length feature vector that is given to a separate classifier (logistic regression or MLP) to classify malware.…”

Section: Recurrent Neural Network Applications In Security Researchmentioning

confidence: 99%

Tiresias

Shen¹,

Mariconti

Vervier

et al. 2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps that will be taken by an adversary when performing an attack. However this is still an open research problem, and previous research in predicting malicious events only looked at binary outcomes (e.g., whether an attack would happen or not), but not at the specific steps that an attacker would undertake. To fill this gap we present Tiresias, a system that leverages Recurrent Neural Networks (RNNs) to predict future events on a machine, based on previous observations. We test Tiresias on a dataset of 3.4 billion security events collected from a commercial intrusion prevention system, and show that our approach is effective in predicting the next event that will occur on a machine with a precision of up to 0.93. We also show that the models learned by Tiresias are reasonably stable over time, and provide a mechanism that can identify sudden drops in precision and trigger a retraining of the system. Finally, we show that the long-term memory typical of RNNs is key in performing event prediction, rendering simpler methods not up to the task. ACM Reference Format:

show abstract

Malware classification with recurrent networks

Cited by 310 publications

References 12 publications

Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

An investigation of a deep learning based malware detection system

Tiresias

Contact Info

Product

Resources

About