When Malware is Packin' Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

When Malware is Packin' Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features

Résumé

Machine learning techniques are widely used in addition to signatures and heuristics to increase the detection rate of anti-malware software, as they automate the creation of detection models, making it possible to handle an ever-increasing number of new malware samples. In order to foil the analysis of anti-malware systems and evade detection, malware uses packing and other forms of obfuscation. However, few realize that benign applications use packing and obfuscation as well, to protect intellectual property and prevent license abuse. In this paper, we study how machine learning based on static analysis features operates on packed samples. Malware researchers have often assumed that packing would prevent machine learning techniques from building effective classifiers. However, both industry and academia have published results that show that machine-learning-based classifiers can achieve good detection rates, leading many experts to think that classifiers are simply detecting the fact that a sample is packed, as packing is more prevalent in malicious samples. We show that, different from what is commonly assumed, packers do preserve some information when packing programs that is "useful" for malware classification. However, this information does not necessarily capture the sample's behavior. We demonstrate that the signals extracted from packed executables are not rich enough for machine-learning-based models to (1) generalize their knowledge to operate on unseen packers, and (2) be robust against adversarial examples. We also show that a naïve application of machine learning techniques results in a substantial number of false positives, which, in turn, might have resulted in incorrect labeling of ground-truth data used in past work.
Fichier principal
Vignette du fichier
publi-6355.pdf (467.34 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04093553 , version 1 (10-05-2023)

Identifiants

Citer

Hojjat Aghakhani, Fabio Gritti, Francesco Mecca, Martina Lindorfer, Stefano Ortolani, et al.. When Malware is Packin' Heat; Limits of Machine Learning Classifiers Based on Static Analysis Features. Network and Distributed System Security Symposium, Feb 2020, San Diego, United States. ⟨10.14722/ndss.2020.24310⟩. ⟨hal-04093553⟩

Collections

EURECOM
18 Consultations
7 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More