Abstract:Nowadays, the rapid growth of the number and variety of malware brings great security challenges. Machine learning has become a mainstream tool for effective malware detection, which can mainly be classified into static and dynamic analysis methods. The purpose of malware detection is to have a good and stable detection performance for different software forms. However, many static analysis methods are easily affected by packing and other code obfuscation techniques, and dynamic analysis methods are commonly believed more robust, while the impact of packing on them has received little attention. In addition, adversarial sample attacks against dynamic analysis methods have also been conducted. This indicates the need to investigate more accurate and robust malware classification methods. In this paper, we propose a new robust dynamic analysis method for malware detection by using specific fine-grained behavioral features, i.e., control flow traces. Further, a malware classifier is constructed by converting control flow traces into byte sequences and applying a combination of convolutional neural networks and long short term memory . The proposed classifier can effectively detect malware with an accuracy of up to 95.7%, as well as detect unseen malware with an accuracy of 94.6% (indicating a good performance in handling the evolution of malware). Meanwhile, it is first found experimentally that packing has specific interference with existing behavior-based malware classifiers, resulting in even worse performance than static classifiers in some cases. However, the proposed classifier performs well in terms of robustness, showing stable performance under the interference of an uneven packing distribution in the dataset, with a 26.3% higher true positive rate for unpacked samples compared to the API call-based classifier. In addition, the classifier is also more robust against adversarial samples, with a detection rate of at least 83%.

Directed Hidden-Code Extractor for Environment-Sensitive Malwares

Happer - Unpacking Android Apps via a Hardware-Assisted Approach.

PackerGrind: An Adaptive Unpacking System for Android Apps.

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

The Research of Information Hiding Technology Based on Portable Executable File Format

Precise system-wide concatic malware unpacking

A fine-grained classification approach for the packed malicious code

Packer Identification Using Hidden Markov Model

UnSafengine64: A Safengine Unpacker for 64-Bit Windows Environments and Detailed Analysis Results on Safengine 2.4.0

MLxPack: Investigating the Effects of Packers on ML-based Malware Detection Systems Using Static and Dynamic Traits

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

EnvFaker - A Method to Reinforce Linux Sandbox Based on Tracer, Filter and Emulator Against Environmental-Sensitive Malware.

You Are What You Do: Hunting Stealthy Malware Via Data Provenance Analysis

Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

Efficient and Robust Malware Detection Based on Control Flow Traces Using Deep Neural Networks

Generic Unpacking Method Based on Detecting Original Entry Point

An Efficient Multi-Step Framework for Malware Packing Identification

POW-HOW: An enduring timing side-channel to evade online malware sandboxes

Early Detection of In-Memory Malicious Activity based on Run-time Environmental Features