Abstract:Nowadays, the rapid growth of the number and variety of malware brings great security challenges. Machine learning has become a mainstream tool for effective malware detection, which can mainly be classified into static and dynamic analysis methods. The purpose of malware detection is to have a good and stable detection performance for different software forms. However, many static analysis methods are easily affected by packing and other code obfuscation techniques, and dynamic analysis methods are commonly believed more robust, while the impact of packing on them has received little attention. In addition, adversarial sample attacks against dynamic analysis methods have also been conducted. This indicates the need to investigate more accurate and robust malware classification methods. In this paper, we propose a new robust dynamic analysis method for malware detection by using specific fine-grained behavioral features, i.e., control flow traces. Further, a malware classifier is constructed by converting control flow traces into byte sequences and applying a combination of convolutional neural networks and long short term memory . The proposed classifier can effectively detect malware with an accuracy of up to 95.7%, as well as detect unseen malware with an accuracy of 94.6% (indicating a good performance in handling the evolution of malware). Meanwhile, it is first found experimentally that packing has specific interference with existing behavior-based malware classifiers, resulting in even worse performance than static classifiers in some cases. However, the proposed classifier performs well in terms of robustness, showing stable performance under the interference of an uneven packing distribution in the dataset, with a 26.3% higher true positive rate for unpacked samples compared to the API call-based classifier. In addition, the classifier is also more robust against adversarial samples, with a detection rate of at least 83%.

Control Flow-Based Opcode Behavior Analysis for Malware Detection

Method of Malware Behavior Analysis in Disassembly Level

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

Deep learning-aided runtime opcode-based Windows malware detection

Malware Detection with LSTM using Opcode Language

A malware detection framework based on kolmogorov complexity

A New Approach to Malware Detection

Opcode Sequence Analysis of Android Malware by a Convolutional Neural Network.

Characterization of Android malware based on opcode analysis

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

MalOSDF: An Opcode Slice-Based Malware Detection Framework Using Active and Ensemble Learning

A method for hidden malcode anomaly detection using dynamic control-flow analysis

Impeding Behavior-Based Malware Analysis Via Replacement Attacks to Malware Specifications

Trinucleotide repeat dynamic mutation identifying susceptibility in familial and sporadic chronic lymphocytic leukaemia

Efficient and Robust Malware Detection Based on Control Flow Traces Using Deep Neural Networks

Malicious Code Detection: Run Trace Output Analysis by LSTM

A Malicious Behavior Analysis Method Based on Program Semantic

Clustering based opcode graph generation for malware variant detection

Dynamic Analysis of Malicious Code

Metamorphic Malware Detection Using Linear Discriminant Analysis and Graph Similarity