Malware Analysis With Machine Learning

PurposeGiven how smart today’s malware authors have become through employing highly sophisticated techniques, it is only logical that methods be developed to combat the most potent threats, particularly where the malware is stealthy and makes indicators of compromise (IOC) difficult to detect. After the analysis is completed, the output can be employed to detect and then counteract the attack. The goal of this work is to propose a machine learning approach to improve malware detection by combining the strengths of both supervised and unsupervised machine learning techniques. This study is essential as malware has certainly become ubiquitous as cyber-criminals use it to attack systems in cyberspace. Malware analysis is required to reveal hidden IOC, to comprehend the attacker’s goal and the severity of the damage and to find vulnerabilities within the system.Design/methodology/approachThis research proposes a hybrid approach for dynamic and static malware analysis that combines unsupervised and supervised machine learning algorithms and goes on to show how Malware exploiting steganography can be exposed.FindingsThe tactics used by malware developers to circumvent detection are becoming more advanced with steganography becoming a popular technique applied in obfuscation to evade mechanisms for detection. Malware analysis continues to call for continuous improvement of existing techniques. State-of-the-art approaches applying machine learning have become increasingly popular with highly promising results.Originality/valueCyber security researchers globally are grappling with devising innovative strategies to identify and defend against the threat of extremely sophisticated malware attacks on key infrastructure containing sensitive data. The process of detecting the presence of malware requires expertise in malware analysis. Applying intelligent methods to this process can aid practitioners in identifying malware’s behaviour and features. This is especially expedient where the malware is stealthy, hiding IOC.

The cyber world is plagued with ever-evolving malware that readily infiltrate all defense mechanisms, operate viciously unbeknownst to the user, and surreptitiously exfiltrate sensitive data. Understanding the inner workings of such malware provides a leverage to effectively combat them. This understanding is pursued often through dynamic analysis which is conducted manually or automatically. Malware authors accordingly, have devised and advanced evasion techniques to thwart or evade these analyses. In this article, we present a comprehensive survey on malware dynamic analysis evasion techniques. In addition, we propose a detailed classification of these techniques and further demonstrate how their efficacy holds against different types of detection and analysis approaches. Our observations attest that evasive behavior is mostly concerned with detecting and evading sandboxes. The primary tactic of such malware we argue is fingerprinting followed by new trends for reverse Turing test tactic which aims at detecting human interaction. Furthermore, we will posit that the current defensive strategies, beginning with reactive methods to endeavors for more transparent analysis systems, are readily foiled by zero-day fingerprinting techniques or other evasion tactics such as stalling. Accordingly, we would recommend the pursuit of more generic defensive strategies with an emphasis on path exploration techniques that has the potential to thwart all the evasive tactics.

Advanced persistent threats (APT) are major threats in the field of system and network security. They are extremely stealthy and use advanced evasion techniques like packing and behaviour obfuscation to hide their malicious behaviour and evade the detection methods. Existing behavior-based detection technique fails to detect the APTs due to its high persistence mechanism and sophisticated code nature. Hence, a novel hybrid analysis technique using Behavior based Sandboxing approach is proposed. The proposed technique consists of four phases namely, Static, Dynamic, Memory and System state analysis. Initially, static analysis is performed on the sample which involves packer detection and signature verification. If the sample is found stealthy and remains undetected, then it is executed inside a sandbox environment to analyze its behavior. Further, memory analysis is performed to extract memory artefacts of the current system state. Finally, system state analysis is performed by correlating clean system state and infected system state to determine whether the system is compromised

Heuristic resolution for multiple inheritance in object-oriented expert system building tools

To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

The thermal profile of data centers plays a significant role in affecting the cooling cost and power budget of the system. While several dynamic and static approaches have been proposed so far, these have failed on considering the whole picture. This paper proposes a combined static and dynamic approach that shows the benefits of the efficient scheduling strategies on leading to thermal-efficient floorplans. The devised methodology comes out with a placement of processors and task scheduling for a heterogeneous system, where the main thermal metrics (maximum temperature and thermal gradient) have been optimized.

The automation of business enterprises, the bulk computer storage to store sensitive information, various distributed applications being accessed via the Internet, all these have become critical for the government, financial institutions, and millions of users. Cyber security plays an important role to identify different types of risks and to overcome the challenges of securing the information thereby preventing financial and reputational damage to the organization and its customers. This work introduces some known threats to Cyber Security—Keylogger and Adware, and how they are spoofed and sent to a victim, with which an attacker can surreptitiously break into a network system. This study shows how anyone on the Internet can fall prey to such malware attacks, and how a user needs to protect himself/herself with such increasing number of Internet users. Approaches to prevent these malware programs are also discussed in this paper.KeywordsPhishingMalwareKeyloggerAdwareRisksSecurity

Much has been made in recent months of so-called Advanced Evasion Techniques (AETs) that could be used by hackers and cyber-criminals to bypass IT security defences. Do the claims stand up to technical scrutiny? Steve Gold investigates and discovers that AETs may not be as new as some experts claim. The basic techniques were outlined 12 years ago but the technology wasn't available then to exploit them. Now that we have sufficiently powerful computers to mount such attacks, they are easily thwarted by the proper implementation of intrusion detection and prevention systems – provided these are properly configured. The main danger is that budget constraints might undermine attempts at protection.

Malware Analysis and Classification Systems use static and dynamic techniques, in conjunction with machine learning algorithms, to automate the task of identification and classification of malicious codes. Both techniques have weaknesses that allow the use of analysis evasion techniques, hampering the identification of malwares. In this work, we propose the unification of static and dynamic analysis, as a method of collecting data from malware that decreases the chance of success for such evasion techniques. From the data collected in the analysis phase, we use the C5.0 and Random Forest machine learning algorithms, implemented inside the FAMA framework, to perform the identification and classification of malwares into two classes and multiple categories. In our experiments, we showed that the accuracy of the unified analysis achieved an accuracy of 95.75% for the binary classification problem and an accuracy value of 93.02% for the multiple categorization problem. In all experiments, the unified analysis produced better results than those obtained by static and dynamic analyzes isolated.

Dynamic Binary Instrumentation (DBI) is a dynamic analysis technique that allows arbitrary code to be executed when a program is running. DBI frameworks have started to be used to analyze malicious applications. As a result, different approaches have merged to detect and avoid them. Commonly referred to as split personality malware or evasive malware are pieces of malicious software that incorporate snippets of code to detect when they are under DBI framework analysis and thus mimic benign behavior. Recent studies have questioned the use of DBI in malware analysis, arguing that it increases the attack surface. In this article, we examine the anti-instrumentation techniques that abuse desktop-based DBI frameworks and existing countermeasures to determine if it is possible to reduce the exploitable attack surface introduced by these DBI frameworks. In particular, we review the related literature to identify (i) the existing set of DBI framework evasion techniques and (ii) the existing set of countermeasures to avoid them. We also analyze and compare the taxonomies introduced in the literature, and propose a new taxonomy that expands and completes the previous taxonomies. Our findings demonstrate that despite advances in DBI framework protections that make them quite suitable for system security purposes, more efforts are needed to reduce the attack surface that they add during application analysis. Only 12 of the 26 evasion techniques covered in this document have countermeasures, threatening the transparency of DBI frameworks. Furthermore, the impact in terms of performance overhead and effectiveness of these countermeasures in real-world situations is unknown. Finally, there are only proofs of concept for 9 of these 26 techniques, which makes it difficult to validate and study how they evade the analysis in order to counter them. We also point out some relevant issues in this context and outline ways of future research directions in the use of DBI frameworks for system security purposes.

Recent technological innovations and new age computing models in IT infrastructure have provided faster bandwidth speeds, cloud computing, mobile computing and virtualization have virtually melted the boundaries between traditional on premise and internet based enterprise security perimeter. This has created a data-rich digital era, which is in fact an excellent opportunity for hackers and threat vectors leading to cybercrime. In fact, cybercrime has been progressing at the highest pace in last few years. Advanced Persistent Threat or APT is a highly sophisticated threat. Initially, such attacks focused and targeted government, state, or financial institutions only. However, recent breach reports and studies have started to indicate the trend of APT involving wider domains. This chapter takes a critical look at the impact and incidents due to advanced persistent threats and the advanced evasion techniques for packing, encryption, and behavior obfuscation during APT attacks to hide their malicious behavior and evade detection.KeywordsAPTAdvanced persistent threatsCyberattacksCyber threatsCybercrime

Malware analysis is essential to understanding the internal logic and intent of malware programs in order to mitigate their threats. As the analysis methods have evolved, malware authors have adopted more techniques such as the virtualization obfuscation to protect the malware inner workings. This manuscript presents a framework for deobfuscating software which abstracts the input program as much as a mathematical model of its behavior, through monitoring every single operation performed during the malware execution. Alsothe program is guided to run through its di erent execution paths automatically in order to gather as much knowledge as possible in the shortest time span. This makes it possible to nd hidden logics and deobfuscate di erent obfuscation techniques without being dependent on their speci c details. The resulting model is then recoded as a C program without the arti cially added complexities. This code is called a twincode and behaves in the same manner as the obfuscated binary. As a proof of concept, the proposed framework is implemented and its e ectiveness is evaluated on obfuscated binaries. Program control flow graphs areinspected as a measure of successful code recovery. The performance of the proposed framework is evaluated using the set of SPEC test programs.

ContextClimate and land-use changes affect species ranges and movements. However, these changes are usually overlooked in connectivity studies, and this could have adverse consequences in the definition of effective management measures.ObjectivesWe evaluated two ways to incorporate landscape dynamics: (i) by analyzing connectivity as a fluctuating phenomenon (i.e., time-varying connectivity); and (ii) by analyzing species movements from past to current ranges (i.e., spatio-temporal connectivity). We also compared these dynamic approaches with traditional static connectivity methods.MethodsWe compared the overall connectivity values and the prioritization of critical habitat patches according to dynamic and static approaches using habitat availability metrics (Probability of Connectivity and Equivalent Connected Area). This comparative research was conducted for species associated with broadleaf forests of the different ecoregions of the Iberian Peninsula. We considered species habitat preferences during movement and a wide range of dispersal abilities to assess functional connectivity.ResultsStatic approaches generated varying overall connectivity values and priority patches depending on the time snapshot considered and different from those generated by dynamic approaches. The two dynamic connectivity approaches resulted in very similar priority conservation patches, indicating their potential to guide enduring conservation measures that enhance connectivity between contemporary habitat patches at multiple time snapshots but also species range shifts in time.ConclusionsConnectivity is affected by landscape changes, and only dynamic approaches can overcome the issues associated with these changes and provide valuable information to guide improved and enduring measures in changing landscapes.

Evaluation of annual forest disturbance monitoring using a static decision tree approach and 250 m MODIS data

To evaluate the economic efficiency of influenza vaccination using both dynamic and static modelling approaches. The Spanish National Health System. We modelled the progress of an influenza epidemic in Spain according to the epidemiological pattern of susceptible-->infective-->resistant, employing a non-linear system of ordinary differential equations that enables the measurement of epidemiological effects of an anti-influenza vaccination. We used a decision tree to represent the repercussion on healthcare resources use and on financial resources. The same analyses were conducted using a static approach, and the results were compared. Healthcare costs were valued in euro, year 2005 values. For the base case, the impact of the healthcare intervention (vaccination) was not efficient from the perspective of the healthcare payer when using a static approach (return rate 0.28 per euro invested in vaccination). Nevertheless, it was efficient when employing a dynamic approach (return rate 1.22 per euro). Furthermore, a considerable freeing of healthcare resources would have been produced over the entire influenza season. The indirect effect of vaccination on the non-vaccinated individuals (the 'herd immunity effect') can be greater than the direct effect on individuals vaccinated. This implies that the herd immunity effect needs to be taken into consideration in the economic evaluations of prophylactic measures employed against infectious diseases.