Would a File by Any Other Name Seem as Malicious?

Abstract

Successful malware attacks on information technology systems can cause millions of dollars in damage, the exposure of sensitive and private information, and the irreversible destruction of data. Antivirus systems that analyze a file's contents use a combination of static and dynamic analysis to detect and remove/remediate such malware. However, examining a file's entire contents is not always possible in practice, as the volume and velocity of incoming data may be too high, or access to the underlying file contents may be restricted or unavailable. If it were possible to obtain estimates of a file's relative likelihood of being malicious without looking at the file contents, we could better prioritize file processing order and aid analysts in situations where a file is unavailable.In this work, we demonstrate that file names can contain information predictive of the presence of malware in a file. In particular, we show the effectiveness of a character-level convolutional neural network at predicting malware status using file names on Endgame's EMBER malware detection benchmark dataset.

Marvolo: Programmatic Data Augmentation for Practical ML-Driven Malware Detection

“…These models typically consist of neural networks that determine whether or not a given binary is malicious or benign based on various, defining features of that binary. For instance, certain models run inference over PE header values, assembly code, network traffic, and even the names of binaries [2,36]. Others follow a dynamic approach and perform manual feature engineering of API calls [37].…”

Automatic Yara Rule Generation Using Biclustering

“…Toward this goal, we needed to minimize memory use and model size in memory, as well as reliance on any GPU resources. This allows analysts who take "fly-away" kits with them to unfamiliar networks to begin investigations into the network, encountering whatever novel malware that may be present [17]. We also need the tool to produce Yara rules within minutes, as our experience has been that analysts will not, in general, use tools requiring them to wait hours or more.…”