Malware Triage Based on Static Features and Public APT Reports

Abstract

Understanding the behavior of malware requires a semi-automatic approach including complex software tools and human analysts in the loop. However, the huge number of malicious samples developed daily calls for some prioritization mechanism to carefully select the samples that really deserve to be further examined by analysts. This avoids computational resources be overloaded and human analysts saturated. In this paper we introduce a malware triage stage where samples are quickly and automatically examined to promptly decide whether they should be immediately dispatched to human analysts or to other specific automatic analysis queues, rather than following the common and slow analysis pipeline. Such triage stage is encapsulated into an architecture for semi-automatic malware analysis presented in a previous work. In this paper we propose an approach for sample prioritization, and its realization within such architecture. Our analysis in the paper focuses on malware developed by Advanced Persistent Threats (APTs). We build our knowledge base, used in the triage, on known APTs obtained from publicly available reports. To make the triage as fast as possible, only static malware features are considered, which can be extracted with negligible delay, without the necessity of executing the malware samples, and we use them to train a random forest classifier. The classifier has been tuned to maximize its precision, so that analysts and other components of the architecture are mostly likely to receive only malware correctly identified as being similar to known APT, and do not waste important resources on false positives. A preliminary analysis shows high precision and accuracy, as desired.

Malware Triage for Early Identification of Advanced Persistent Threat Activities

“…In this section, we define the methodologies that lead us to define the proposed framework with high performances. In particular, in Section 4.1, we explain the feature extraction process, in Sections 4.2 and 4.3, we respectively discuss the RFT multi-class methodology proposed by Laurenza et al [11] and the one-class classification approach through which we implement the malware triage.…”

“…In fact, this so-called negative class has a cardinality of several orders of magnitude bigger than the set of APT samples, and there is a large variety among its samples. Thus, the result in terms of accuracy and precision are very poor, and for this reason in Reference [11] the authors proposed a Random Forest-based triage (RFT) approach. They trained their model on a knowledge base built upon a collection of ATPs' related reports publicly released by cyber-security firms.…”

“…In the previous malware triage work [11], the authors aim to recognize malware developed by APTs, but, contrary to the other described works, they focus on the sample analysis instead of the malware activity observed during the infection. The work achieves high precision and very high accuracy in detecting the ownership of this kind of malware but suffers the problem highlighted in Section 1.…”

Survey of machine learning techniques for malware analysis

“…There are a number of features in a binary to support this process: and shares some aspects with malware similarity analysis, as they both provide key information to support malware analysis prioritisation. Anyway, they are different because triage requires faster results at the cost of worse accuracy, hence different techniques are usually employed [75,77,101,86].…”

A Survey on Malware Detection and Analysis Tools

“…There have been many studies on the detection and analysis of malware using machine learning that study fine-grained features [34], deep learning [35][36][37], dynamic features [38], static features [36,39], concept drift [40], predicting signatures [41], hybrid framework [42], malware metadata [43], reverse engineering of large datasets of binaries [44].…”