Abstract:We propose a hybrid machine learning architecture that simultaneously employs multiple deep learning models analyzing contextual and behavioral characteristics of Windows portable executable, producing a final prediction based on a decision from the meta-model. The detection heuristic in contemporary machine learning Windows malware classifiers is typically based on the static properties of the sample since dynamic analysis through virtualization is challenging for vast quantities of samples. To surpass this limitation, we employ a Windows kernel emulation that allows the acquisition of behavioral patterns across large corpora with minimal temporal and computational costs. We partner with a security vendor for a collection of more than 100k int-the-wild samples that resemble the contemporary threat landscape, containing raw PE files and filepaths of applications at the moment of execution. The acquired dataset is at least ten folds larger than reported in related works on behavioral malware analysis. Files in the training dataset are labeled by a professional threat intelligence team, utilizing manual and automated reverse engineering tools. We estimate the hybrid classifier's operational utility by collecting an out-of-sample test set three months later from the acquisition of the training set. We report an improved detection rate, above the capabilities of the current state-of-the-art model, especially under low false-positive requirements. Additionally, we uncover a meta-model's ability to identify malicious activity in validation and test sets even if none of the individual models express enough confidence to mark the sample as malevolent. We conclude that the meta-model can learn patterns typical to malicious samples from representation combinations produced by different analysis techniques. We publicly release pre-trained models and anonymized dataset of emulation reports.

Hardening behavioral classifiers against polymorphic malware: An ensemble approach based on minority report

Malware Analysis Using Machine Learning and Deep Learning Techniques

Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing

Updating Windows Malware Detectors: Balancing Robustness and Regression against Adversarial EXEmples

Multi-view Representation Learning from Malware to Defend Against Adversarial Variants

On the Effectiveness of Adversarial Samples against Ensemble Learning-based Windows PE Malware Detectors

Advanced Cybersecurity Enhancement through Mathematical Models: A Comprehensive Approach Using Statistical Methods, Cryptographic Techniques, and Machine Learning Algorithms (SVM, Random Forest, and Neural Networks) for Behavior-Based Malware Detection

Attack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models

MalwareTotal: Multi-Faceted and Sequence-Aware Bypass Tactics Against Static Malware Detection

DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness

Evaluation of Malware Classification Models for Heterogeneous Data

Unmasking the common traits: an ensemble approach for effective malware detection

Small Effect Sizes in Malware Detection? Make Harder Train/Test Splits!

VoteDroid: a new ensemble voting classifier for malware detection based on fine-tuned deep learning models

Quo Vadis: Hybrid Machine Learning Meta-Model based on Contextual and Behavioral Malware Representations

Malware Detection Using Ensemble N-gram Opcode Sequences

Detecting new obfuscated malware variants: A lightweight and interpretable machine learning approach

Behavioral Malware Classification using Convolutional Recurrent Neural Networks

How to Train your Antivirus: RL-based Hardening through the Problem-Space

Adversarial Deep Learning for Robust Detection of Binary Encoded Malware