When Malware Changed Its Mind An Empirical Study of Variable Program Behaviors in the Real World - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

When Malware Changed Its Mind An Empirical Study of Variable Program Behaviors in the Real World

Erin Avllazagaj
  • Fonction : Auteur
Ziyun Zhu
  • Fonction : Auteur
Leyla Bilge
  • Fonction : Auteur
Davide Balzarotti
Tudor Dumitras
  • Fonction : Auteur

Résumé

Behavioral program analysis is widely used for understanding malware behavior, for creating rule-based detectors, and for clustering samples into malware families. However, this approach is ineffective when the behavior of individual samples changes across different executions, owing to environment sensitivity, evasive techniques or time variability. While the inability to observe the complete behavior of a program is a well-known limitation of dynamic analysis, the prevalence of this behavior variability in the wild, and the behavior components that are most affected by it, are still unknown. As the behavioral traces are typically collected by executing the samples in a controlled environment, the models created and tested using such traces do not account for the broad range of behaviors observed in the wild, and may result in a false sense of security. In this paper we conduct the first quantitative analysis of behavioral variability in Windows malware, PUP and benign samples, using a novel dataset of 7.6M execution traces, recorded in 5.4M real hosts from 113 countries. We analyze program behaviors at multiple granularities, and we show how they change across hosts and across time. We then analyze the invariant parts of the malware behaviors, and we show how this affects the effectiveness of malware detection using a common class of behavioral rules. Our findings have actionable implications for malware clustering and detection, and they emphasize that program behavior in the wild depends on a subtle interplay of factors that may only be observed at scale, by monitoring malware on real hosts.
Fichier principal
Vignette du fichier
publi-6594.pdf (502.41 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04093477 , version 1 (10-05-2023)

Identifiants

  • HAL Id : hal-04093477 , version 1

Citer

Erin Avllazagaj, Ziyun Zhu, Leyla Bilge, Davide Balzarotti, Tudor Dumitras. When Malware Changed Its Mind An Empirical Study of Variable Program Behaviors in the Real World. USENIX 2021, 30th USENIX Security Symposium, 11-13 August 2021, Usenix, Aug 2021, Online, United States. ⟨hal-04093477⟩

Collections

EURECOM
27 Consultations
29 Téléchargements

Partager

Gmail Facebook X LinkedIn More