Unknown malcode detection via text categorization and the imbalance problem

Abstract

Today's signature-based anti-viruses are very accurate, but are limited in detecting new malicious code. Currently, dozens of new malicious codes are created every day, and this number is expected to increase in the coming years. Recently, classification algorithms were used successfully for the detection of unknown malicious code. These studies used a test collection with a limited size where the same malicious-benign-file ratio in both the training and test sets, which does not reflect reallife conditions. In this paper we present a methodology for the detection of unknown malicious code, based on text categorization concepts. We performed an extensive evaluation using a test collection that contains more than 30,000 malicious and benign files, in which we investigated the imbalance problem. In real-life scenarios, the malicious file content is expected to be low, about 10% of the total files. For practical purposes, it is unclear as to what the corresponding percentage in the training set should be. Our results indicate that greater than 95% accuracy can be achieved through the use of a training set that contains below 20% malicious file content.

Unknown Malcode Detection Using OPCODE Representation

“…We performed an extensive evaluation of a test collection of more than 30,000 files, in which we evaluated extensively the OpCode n-gram representation and investigated the imbalance problem, referring to real-life scenarios, in which the malicious file content is expected to be about 10% of the total files. Our results indicate that greater than 99% accuracy can be achieved through the use of a training set that has a malicious file percentage lower than 15%, which is higher than in our previous experience with byte sequence n-gram representation [1]. …”

“…A classifier is a rule set that is learnt from a given training set, including examples of classes, both malicious and benign files in our case. Recent studies, which we survey in the next section, and our experience [1], have shown that using byte sequence ngrams to represent the binary files yields very good results. A recent survey 1 done by McAfee indicates that about 4% of search results from the major search engines on the web contain malicious code.…”

“…Recently, Moskovitch et al [1] reported a study consisting of the largest test collection currently reported, including more than 30,000 files, in which the files were represented by byte sequence n-grams. In addition to an extensive evaluation of 3 to 6 n-grams, three feature selection methods and eight classifiers, an investigation of the imbalance problem, on which we elaborate later, was demonstrated.…”

“…The collection, which, to the best of our knowledge, is the largest ever assembled and used for research, was used in [1]. We acquired the malicious files from the VX Heaven website 2 .…”

“…We had two representations, the known one, often called n-grams, which consists of byte sequences of characters extracted from the binary code [1], and the OpCodes, which were represented by sequences of OpCodes. We extracted a sequence of OpCodes from each file representing execution flow of machine operations, using a disassembler program.…”