Does Every Second Count? Time-based Evolution of Malware Behavior in Sandboxes
Résumé
The amount of time in which a sample is executed
is one of the key parameters of a malware analysis sandbox.
Setting the threshold too high hinders the scalability and reduces
the number of samples that can be analyzed in a day; too
low and the samples may not have the time to show their
malicious behavior, thus reducing the amount and quality of the
collected data. Therefore, an analyst needs to find the ‘sweet spot’
that allows to collect only the minimum amount of information
required to properly classify each sample. Anything more is
wasting resources, anything less is jeopardizing the experiments.
Despite its importance, there are no clear guidelines on how to
choose this parameter, nor experiments that can help companies
to assess the pros and cons of a choice over another. To fill
this gap, in this paper we provide the first large-scale study of
the impact that the execution time has on both the amount and
the quality of the collected events. We measure the evolution
of system calls and code coverage, to draw a precise picture of
the fraction of runtime behavior we can expect to observe in
a sandbox. Finally, we implemented a machine learning based
malware detection method, and applied it to the data collected
in different time windows, to also report on the relevance of the
events observed at different points in time.
Our results show that most samples run for either less than
two minutes or for more than ten. However, most of the behavior
(and 98% of the executed basic blocks) are observed during the
first two minutes of execution, which is also the time windows that
result in a higher accuracy of our ML classifier. We believe this
information can help future researchers and industrial sandboxes
to better tune their analysis systems.
Domaines
Informatique [cs]Origine | Fichiers produits par l'(les) auteur(s) |
---|