Malware modeling and experimentation through parameterized behavior

Abstract

Experimentation is critical to understanding the malware operation and to evaluating potential defenses. However, constructing the controlled environments needed for this experimentation is both time-consuming and error-prone. In this study, we highlight several common mistakes made by researchers and conclude that existing evaluations of malware detection techniques often lack in both flexibility and transparency. For instance, we show that small variations in the malware’s behavioral parameters can have a significant impact on the evaluation results. These variations, if unexplored, may lead to overly optimistic conclusions and detection systems that are ineffective in practice. To overcome these issues, we propose a framework to model malware behavior and guide systematic parameter selection. We evaluate our framework using a synthetic botnet executed within the CyberVAN testbed. Our study is intended to foster critical evaluation of proposed detection techniques and stymie unintentionally erroneous experimentation.

Extending Detection with Privileged Information via Generalized Distillation

“…Feature cultivation in these detection systems has been a key effort within the security communities. For example, researchers have previously used specific patterns to group malware samples into families [23], [30], have explored using DNS information to understand and predict botnet domains [20], [31], [32], and have analyzed system and network level features to identify malware traffic [33]- [35]. Other works have focused on user authentication using the facial images [36], [37].…”