Integration of Static and Dynamic Analysis for Malware Family Classification with Composite Neural Network

Deep learning has been used in the research of malware analysis. Most classification methods use either static analysis features or dynamic analysis features for malware family classification, and rarely combine them as classification features and also no extra effort is spent integrating the two types of features. In this paper, we combine static and dynamic analysis features with deep neural networks for Windows malware classification. We develop several methods to generate static and dynamic analysis features to classify malware in different ways. Given these features, we conduct experiments with composite neural network, showing that the proposed approach performs best with an accuracy of 83.17% on a total of 80 malware families with 4519 malware samples. Additionally, we show that using integrated features for malware family classification outperforms using static features or dynamic features alone. We show how static and dynamic features complement each other for malware classification.

[1]  Philip K. Chan,et al.  Malware classification using static analysis based features , 2017, 2017 IEEE Symposium Series on Computational Intelligence (SSCI).

[2]  Lukasz Kaiser,et al.  Attention is All you Need , 2017, NIPS.

[3]  Meng Chang Chen,et al.  Theoretical Investigation of Composite Neural Network , 2019, ArXiv.

[4]  Quoc V. Le,et al.  Distributed Representations of Sentences and Documents , 2014, ICML.

[5]  Korea,et al.  Malware Images Classification Using Convolutional Neural Network , 2018 .

[6]  Meng Chang Chen,et al.  A cooperative botnet profiling and detection in virtualized environment , 2013, 2013 IEEE Conference on Communications and Network Security (CNS).

[7]  Xiaodong He,et al.  A Multi-View Deep Learning Approach for Cross Domain User Modeling in Recommendation Systems , 2015, WWW.

[8]  Meng Chang Chen,et al.  Virtual Machine Introspection Based Malware Behavior Profiling and Family Grouping , 2017, ArXiv.

[9]  Diyi Yang,et al.  Hierarchical Attention Networks for Document Classification , 2016, NAACL.

[10]  Dacheng Tao,et al.  A Survey on Multi-view Learning , 2013, ArXiv.

[11]  Spiros Mancoridis,et al.  Behavioral Malware Classification using Convolutional Recurrent Neural Networks , 2018, 2018 13th International Conference on Malicious and Unwanted Software (MALWARE).

[12]  Jack W. Stokes,et al.  Malware classification with LSTM and GRU language models and a character-level CNN , 2017, 2017 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP).

[13]  Takeshi Yagi,et al.  Malware Detection with Deep Neural Network Using Process Behavior , 2016, 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC).

[14]  Bartosz Krawczyk,et al.  Online ensemble learning with abstaining classifiers for drifting and noisy data streams , 2017, Appl. Soft Comput..

[15]  Jack W. Stokes,et al.  Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Detection Models , 2018, MILCOM 2018 - 2018 IEEE Military Communications Conference (MILCOM).

[16]  Sung-Bae Cho,et al.  Malware Detection Using Deep Transferred Generative Adversarial Networks , 2017, ICONIP.

[17]  John Cavazos,et al.  Efficient Characterization and Classification of Malware Using Deep Learning , 2018, 2018 Resilience Week (RWS).

[18]  Jack W. Stokes,et al.  Robust Neural Malware Detection Models for Emulation Sequence Learning , 2018, MILCOM 2018 - 2018 IEEE Military Communications Conference (MILCOM).

[19]  Razvan Pascanu,et al.  Malware classification with recurrent networks , 2015, 2015 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP).

[20]  Gianluca Stringhini,et al.  A Family of Droids: Analyzing Behavioral Model based Android Malware Detection via Static and Dynamic Analysis , 2018, ArXiv.

[21]  Zhenlong Yuan,et al.  DroidDetector: Android Malware Characterization and Detection Using Deep Learning , 2016 .

[22]  V. S. Subrahmanian,et al.  EC2: Ensemble Clustering and Classification for Predicting Android Malware Families , 2020, IEEE Transactions on Dependable and Secure Computing.

[23]  Conrad D. James,et al.  Dynamic Analysis of Executables to Detect and Characterize Malware , 2017, 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA).

[24]  Yong Qi,et al.  Detecting Malware with an Ensemble Method Based on Deep Neural Network , 2018, Secur. Commun. Networks.