Neurlux

Abstract

Malware detection plays a vital role in computer security. Modern machine learning approaches have been centered around domain knowledge for extracting malicious features. However, many potential features can be used, and it is time consuming and difficult to manually identify the best features, especially given the diverse nature of malware.In this paper, we propose Neurlux, a neural network for malware detection. Neurlux does not rely on any feature engineering, rather it learns automatically from dynamic analysis reports that detail behavioral information. Our model borrows ideas from the field of document classification, using word sequences present in the reports to predict if a report is from a malicious binary or not. We investigate the learned features of our model and show which components of the reports it tends to give the highest importance. Then, we evaluate our approach on two different datasets and report formats, showing that Neurlux improves on the state of the art and can effectively learn from the dynamic analysis reports. Furthermore, we show that our approach is portable to other malware analysis environments and generalizes to different datasets. CCS CONCEPTS• Security and privacy → Software and application security; • Computing methodologies → Neural networks.

Binary Code Representation With Well-Balanced Instruction Normalization

“…Penetrating the characteristics of a machine-interpretable binary code has a wide range of real-world applications including i) code clone (software plagiarism) or similarity detection [14,15,17,18,40,43,55,67,68,69,71,74], ii) malware family classification [28], detection [5,6,35], and analysis [32,36,72], iii) authorship prediction [31,37], iv) known bug discovery (code search) [7,8,9,19,38,42,51,52,57,58], v) patching analysis [20,29,64], and vi) toolchain provenance [48,56]. Most of these applications pertain to binary similarity comparison.…”

“…Recent advancements in machine learning techniques have received considerable attention for their applicability in binary analysis, addressing both effectiveness and efficiency. Malware analysis is one of popular applications: i) BinDNN [36] leverages deep neural networks (e.g., LSTM) for function matching for malware, ii) Zhang et al [72] present dynamic malware analysis with feature engineering (API calls), and iii) Neurlux [32] proposes a system that learns features automatically from a dynamic analysis report (i.e., behavioral information of malware). Code similarity detection is another active domain using a probabilistic approach.…”

Dynamic Malware Detection Using Parameter-Augmented Semantic Chain

“…First, we remove the hash values from the parameters. Most of these hashes represent a certain area in memory, i.e., virtual addresses, and these virtual addresses change with different devices, so virtual addresses are not such important information for dynamic detection methods based on API sequences [29,30], and hashes are more difficult to handle compared to other parameters. Therefore, the hash values in the parameters are not processed.…”

Deceiving ML-Based Friend-or-Foe Identification for Executables

“…Modern malware-detection systems often leverage both dynamic and static analyses to determine maliciousness [8,25,44,90,93]. While in most cases an attacker would hence need to adopt countermeasures against both of these types of analyses, in other situations, such as potential attacks on end-user systems protected predominantly through static analysis based antivirus detectors [20,95], defeating a static malware detector could be sufficient for an attacker to achieve their goals.…”

“…Modern malware detectors, both academic (e.g., [4,44]) and commercial (e.g., [25,90]), increasingly rely on machine learning (ML) to classify executables as benign or malicious based on features such as imported libraries and API calls. In the space of static malware detection, where an executable is classified prior to its execution, recent efforts have proposed deep neural networks (DNNs) that detect malware from binaries' raw byte-level representation, with effectiveness similar to that of detectors based on hand-crafted features selected through tedious manual processing [54,76].…”