Machine Learning for Malware Detection: Beyond Accuracy Rates
0 likes103 views
The document discusses the methodology and evaluation of machine learning techniques for malware detection, emphasizing the importance of feature extraction for improved accuracy rates. It presents findings that dynamic features outperform static features and highlights the influence of dataset characteristics on machine learning models. The conclusion reiterates the need for effective feature analysis and provides insights into future directions for research in this area.
Machine Learning for Malware Detection: Beyond Accuracy Rates
- 1. Motivation Methodology Evaluation Conclusion Machine Learning for Malware Detection: Beyond Accuracy Rates Lucas Galante, Marcus Botacin, Andr´e Gr´egio, Paulo L´ıcio de Geus SBSEG 2019 Machine Learning for Malware Detection: Beyond Accuracy Rates 1 / 17
- 2. Motivation Methodology Evaluation Conclusion Agenda 1 Motivation Motivation 2 Methodology Malware Classifier 3 Evaluation Beyond Accuracy Rates 4 Conclusion Conclusion Machine Learning for Malware Detection: Beyond Accuracy Rates 2 / 17
- 3. Motivation Methodology Evaluation Conclusion Motivation Agenda 1 Motivation Motivation 2 Methodology Malware Classifier 3 Evaluation Beyond Accuracy Rates 4 Conclusion Conclusion Machine Learning for Malware Detection: Beyond Accuracy Rates 3 / 17
- 4. Motivation Methodology Evaluation Conclusion Motivation Malware Increase Figure: Increase of 46% in malware activity in Q2 of 2019. https://tinyurl.com/y6qzn83h Machine Learning for Malware Detection: Beyond Accuracy Rates 4 / 17
- 5. Motivation Methodology Evaluation Conclusion Motivation Malware Classification Figure: Necessity of antimalware applications. https://tinyurl.com/y2bz5k58 Machine Learning for Malware Detection: Beyond Accuracy Rates 5 / 17
- 6. Motivation Methodology Evaluation Conclusion Malware Classifier Agenda 1 Motivation Motivation 2 Methodology Malware Classifier 3 Evaluation Beyond Accuracy Rates 4 Conclusion Conclusion Machine Learning for Malware Detection: Beyond Accuracy Rates 6 / 17
- 7. Motivation Methodology Evaluation Conclusion Malware Classifier Extracted Features Table: Malware Features classified according extraction method (static and dynamic) and representation (discrete or continuous). Static Dynamic Discrete Continuous Both Embedded files Dissasembly fail Size sections # headers fork syscall /proc access /home string ptrace syscall /home string # .dynamic ptrace syscall /home access /sys string Network strings /sys string # sections socket syscall passwd access Linkage Header present passwd string # symbols mmap syscal permission denied UPX passwd string # libs # relocations SIGTERM fork syscall compiler string Size sample # debug section SIGSEGV Machine Learning for Malware Detection: Beyond Accuracy Rates 7 / 17
- 8. Motivation Methodology Evaluation Conclusion Malware Classifier Classification Overview Figure: Overview of classification process. Machine Learning for Malware Detection: Beyond Accuracy Rates 8 / 17
- 9. Motivation Methodology Evaluation Conclusion Beyond Accuracy Rates Agenda 1 Motivation Motivation 2 Methodology Malware Classifier 3 Evaluation Beyond Accuracy Rates 4 Conclusion Conclusion Machine Learning for Malware Detection: Beyond Accuracy Rates 9 / 17
- 10. Motivation Methodology Evaluation Conclusion Beyond Accuracy Rates Importance of a Good Feature Extraction Procedure SVM classification of static continuous features. Kernel/Iter(#) 1000 10000 100000 Poly 49.32% 49.74% 49.95% Linear 73.87% 77.64% 80.94% rbf 84.92% 84.92% 84.92% SVM classification of dynamic continuous features. Kernel/ Iter (#) 1000 10000 100000 Poly 49.92% 49.76% 50.71% Linear 93.73% 86.51% 86.73% rbf 92.63% 92.63% 92.63% Machine Learning for Malware Detection: Beyond Accuracy Rates 10 / 17
- 11. Motivation Methodology Evaluation Conclusion Beyond Accuracy Rates Importance of Evaluated Datasets Mixed dataset. Random Forest classification of static continuous features. Max Depth/ Estimators (#) 16 32 64 8 99.17% 99.06% 99.20% 16 99.13% 99.06% 99.09% 32 99.09% 99.13% 99.17% VirusTotal dataset. Random Forest classification of static continuous features. Max Depth/ Estimators (#) 16 32 64 8 94.29% 94.35% 94.24% 16 94.24% 94.14% 94.08% 32 94.08% 94.14% 94.19% Machine Learning for Malware Detection: Beyond Accuracy Rates 11 / 17
- 12. Motivation Methodology Evaluation Conclusion Beyond Accuracy Rates Analyst Importance SVM classification of dynamic continuous features. Kernel/ Iter (#) 1000 10000 100000 Poly 50.91% 54.05% 58.16% Linear 97.97% 97.56% 80.35% rbf 98.54% 98.54% 98.54% SVM classification of dynamic discrete features. Kernel/ Iter (#) 1000 10000 100000 Poly 79.68% 79.91% 79.91% Linear 96.48% 96.48% 96.48% rbf 96.35% 96.35% 96.35% Machine Learning for Malware Detection: Beyond Accuracy Rates 12 / 17
- 13. Motivation Methodology Evaluation Conclusion Beyond Accuracy Rates What ML results teach us Static feature importance Static Discrete Continuous Network strings 40% Binary size 27% UPX present 17% # headers 16.70% passwd strings 1.40% # debug sections 0.20% Dynamic feature importance Dynamic Discrete Continuous mmap 50% # mmap 68% fork 6% # fork 10.80% SIGSEGV 10.60% # SIGSEGV 1.30% Machine Learning for Malware Detection: Beyond Accuracy Rates 13 / 17
- 14. Motivation Methodology Evaluation Conclusion Conclusion Agenda 1 Motivation Motivation 2 Methodology Malware Classifier 3 Evaluation Beyond Accuracy Rates 4 Conclusion Conclusion Machine Learning for Malware Detection: Beyond Accuracy Rates 14 / 17
- 15. Motivation Methodology Evaluation Conclusion Conclusion Conclusion Our results show that: Dynamic features outperforms static features Discrete features present smaller accuracy variance Dataset’s distinct characteristics impose challenges to ML models Feature analysis can be used as feedback information Machine Learning for Malware Detection: Beyond Accuracy Rates 15 / 17
- 16. Motivation Methodology Evaluation Conclusion Conclusion Acknowledgement This work is supported by: Brazilian National Counsel of Technological and Scientific Development CESeg assistance Machine Learning for Malware Detection: Beyond Accuracy Rates 16 / 17
- 17. Motivation Methodology Evaluation Conclusion Conclusion Questions, Critics and Suggestions. Contact galante@lasca.ic.unicamp.br Complete version https://github.com/marcusbotacin/ELF.Classifier Previous work https://github.com/marcusbotacin/Linux.Malware Reverse Engineering Workshop Thursday @ 13:30 Machine Learning for Malware Detection: Beyond Accuracy Rates 17 / 17