Decoding the Secrets of Machine Learning in Windows Malware Classification: A Deep Dive into Datasets, Features, and Model Performance - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

Decoding the Secrets of Machine Learning in Windows Malware Classification: A Deep Dive into Datasets, Features, and Model Performance

Résumé

Many studies have proposed machine-learning (ML) models for malware detection and classification, reporting an almost-perfect performance. However, they assemble ground-truth in different ways, use diverse static-and dynamic-analysis techniques for feature extraction, and even differ on what they consider a malware family. As a consequence, our community still lacks an understanding of malware classification results: whether they are tied to the nature and distribution of the collected dataset, to what extent the number of families and samples in the training dataset influence performance, and how well static and dynamic features complement each other. This work sheds light on those open questions by investigating the impact of datasets, features, and classifiers on ML-based malware detection and classification. For this, we collect the largest balanced malware dataset so far with 67k samples from 670 families (100 samples each), and train state-of-the-art models for malware detection and family classification using our dataset. Our results reveal that static features perform better than dynamic features, and that combining both only provides marginal improvement over static features. We discover no correlation between packing and classification accuracy, and that missing behaviors in dynamically-extracted features highly penalise their performance. We also demonstrate how a larger number of families to classify makes the classification harder, while a higher number of samples per family increases accuracy. Finally, we find that models trained on a uniform distribution of samples per family better generalize on unseen data. CCS CONCEPTS • Security and privacy → Malware and its mitigation;
Fichier principal
Vignette du fichier
3576915.3616589CCS.pdf (1.05 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04321280 , version 1 (04-12-2023)

Licence

Paternité

Identifiants

Citer

Savino Dambra, Yufei Han, Simone Aonzo, Platon Kotzias, Antonino Vitale, et al.. Decoding the Secrets of Machine Learning in Windows Malware Classification: A Deep Dive into Datasets, Features, and Model Performance. CCS 2023 - 30th ACM Conference on Computer and Communications Security, Nov 2023, Copenhagen, Denmark. pp.60-74, ⟨10.1145/3576915.3616589⟩. ⟨hal-04321280⟩
88 Consultations
55 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More