Robust Neural Malware Detection Models for Emulation Sequence Learning

Abstract

Malicious software, or malware, presents a continuously evolving challenge in computer security. These embedded snippets of code in the form of malicious files or hidden within legitimate files cause a major risk to systems with their ability to run malicious command sequences. Malware authors even use polymorphism to reorder these commands and create several malicious variations. However, if executed in a secure environment, one can perform early malware detection on emulated command sequences. The models presented in this paper leverage this sequential data derived via emulation in order to perform Neural Malware Detection. These models target the core of the malicious operation by learning the presence and pattern of co-occurrence of malicious event actions from within these sequences. Our models can capture entire event sequences and be trained directly using the known target labels. These end-to-end learning models are powered by two commonly used structures -Long Short-Term Memory (LSTM) Networks and Convolutional Neural Networks (CNNs). Previously proposed sequential malware classification models process no more than 200 events. Attackers can evade detection by delaying any malicious activity beyond the beginning of the file. We present specialized models that can handle extremely long sequences while successfully performing malware detection in an efficient way. We present an implementation of the Convoluted Partitioning of Long Sequences approach in order to tackle this vulnerability and operate on long sequences. We present our results on a large dataset consisting of 634,249 file sequences, with extremely long file sequences.Machine learning models can be trained to learn both the presence and sequential occurrence of events leading to malicious actions. Neural networks for sequential learning like Long Short-Term Memory or LSTM [18,12] recurrent neural networks excel at tasks of learning sequences with a fixed vocabulary. They have shown exemplary results over the past few years in primary sequential learning domains like speech [14] and natural language modeling and translation [4,31]. Besides these, LSTMs have shown significant success in a much broader range of sequential problems as well. Pointer Networks [33], Neural Turing Machines and Differentiable Neural Computers [16,15], have demonstrated the ability of LSTMs to be used for far more complex tasks when augmented with attention [35] and memory [34].AI-based learning models for malware detection, therefore, can be constructed with the help of LSTMs when event sequences are available. Use of language models with Recurrent Neural Networks (RNNs) has been demonstrated by [25,2] on malware detection tasks. The two primary objectives in such problems are event presence detection and sequential occurrence binding. LSTMs, in particular, are excellent operators for sequential occurrence, and hence lead to significantly improved results in the process. Presence detection, while done efficiently by RNNs and LSTMs, is a specialty of the Convolutional Neu...

Actor Critic Deep Reinforcement Learning for Neural Malware Control

“…The baseline file classifier and event classifier employed in this work use the LSTM-based recurrent neural network architectures proposed by (Athiwaratkun and Stokes 2017). Recurrent models which proposed combining a CNN and an LSTM were proposed by (Kolosnjaji et al 2016) and (Agrawal et al 2018).…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…An anti malware engine generates a very long API call sequences which is a problem for detecting malware. The problem is solved in [294] using neural malware detection models. In this paper, experiments were conducted using different end to end models.…”

Malware Detection Using Ensemble N-gram Opcode Sequences

“…On the other hand, the dynamic approach executes the binary in a controlled environment to collect features like API call traces, network-related information, memory and register usage, etc. [13,14,15]. While static analysis could be undermined by obfuscation, dynamic analysis is proven to be resilient against heavily packed malware but could be time consuming.…”