Source-linked AI summary
eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys
Joshua Saxe, Konstantin Berlin
TL;DR
Security machine-learning systems remain costly to develop and maintain because evolving threats require continual feature engineering. eXpose learns directly from raw short character strings using character-level embeddings and convolutions, and it outperforms manual-feature baselines across the tested intrusion-detection problems, with a 5%-10% detection-rate gain at a 0.1% false-positive rate.
Problem
Security machine-learning systems require substantial expert effort to develop and maintain, partly because evolving attacks require their feature representations to be updated.
Method
eXpose uses character-level embeddings and convolutional neural networks to learn features and classify raw short character strings as malicious or benign.
Results
5%-10% higher detection rate at a 0.1% false-positive rate was achieved by eXpose than by manual-feature machine-learning baselines across all tested intrusion-detection problems.
Takeaways & Limitations
eXpose demonstrates the potential of deep learning to address hard cybersecurity detection problems while automating feature design and extraction from raw inputs.
Takeaways & Limitations
Training on longer strings was computationally costly, preventing experiments with more complex architectures.
Abstract
from arXiv · showhide
For years security machine learning research has promised to obviate the need for signature based detection by automatically learning to detect indicators of attack. Unfortunately, this vision hasn't come to fruition: in fact, developing and maintaining today's security machine learning systems can require engineering resources that are comparable to that of signature-based detection systems, due in part to the need to develop and continuously tune the "features" these machine learning systems look at as attacks evolve. Deep learning, a subfield of machine learning, promises to change this by operating on raw input signals and automating the process of feature design and extraction. In this paper we propose the eXpose neural network, which uses a deep learning approach we have developed to take generic, raw short character strings as input (a common case for security inputs, which include artifacts like potentially malicious URLs, file paths, named pipes, named mutexes, and registry keys), and learns to simultaneously extract features and classify using character-level embeddings and convolutional neural network. In addition to completely automating the feature design and extraction process, eXpose outperforms manual feature extraction based baselines on all of the intrusion detection problems we tested it on, yielding a 5%-10% detection rate gain at 0.1% false positive rate compared to these baselines.
1 Introduction
Security machine-learning systems have been limited in real-world prevalence partly because their features require substantial expert development and maintenance. eXpose addresses this burden by learning from raw short character strings and outperforms manual-feature baselines across tested intrusion-detection problems.
- Machine-learning security systems have seen limited real-world prevalence partly because they require significant expert effort to develop and maintain.
- Feature representations must be explored for each artifact type and updated as cyber-attacks evolve, making feature engineering a costly development task.
- eXpose takes generic short character strings as input and learns to detect malicious behavior from their lexical semantics.
- eXpose detects malicious URLs, file paths, and registry keys using a single deep-learning approach to raw security inputs.
- 5%-10% higher detection rate at deployment-relevant false-positive rates was achieved by eXpose than by manual-feature machine-learning baselines across all tested intrusion-detection problems.
- The paper presents eXpose as evidence of the potential of deep learning for hard security-detection problems.
2 Previous Work
Prior security-detection work commonly targets individual problems or dynamic host observations, whereas eXpose learns representations directly from individual input strings. Its character-level convolutional approach connects cybersecurity detection with deep-learning methods that reduce manual feature design.
- eXpose is a generic detection tool addressing multiple cybersecurity problems rather than focusing on one individual detection task.
- Earlier behavioral malware-detection methods generally classify sequences of dynamic process or operating-system events using manually defined representations.
- eXpose instead operates on individual events and learns representations of strings such as file paths and registry keys during detection training.
- For malicious URLs, eXpose uses only URL strings, unlike approaches that also use registration, content, or network-reputation information.
- CNNs apply learned kernels directly to raw inputs, exploiting locality while reducing parameters relative to fully dense networks.
- Character-level embeddings avoid requiring syntactical knowledge such as word boundaries or punctuation.
- RNNs can learn long-term dependencies but are costly and difficult to train because information must be propagated sequentially and gradients can vanish.
- Multi-task learning shares network layers across related tasks, but its usefulness is limited here because character meanings differ across detection problems and labeled data is virtually unlimited.
3 Method
eXpose processes raw short character strings through jointly optimized character embeddings, convolutional feature extraction, and dense classification. The architecture learns local sequence patterns and classifies artifacts as malicious or benign without manually designed features.
- Architecture: eXpose divides processing into character embedding, feature detection, and classification components optimized jointly with stochastic gradient descent.The embedding converts characters to vectors, feature detection produces a fixed-length representation, and a dense network performs classification.
- Character Embedding: The model maps each raw length-s character sequence to an s × m floating-point matrix whose rows preserve character order and columns represent embedding dimensions.Each character is independently mapped through a dictionary lookup before the vectors are concatenated.
- Character Embedding: The embedding layer is trained jointly through backpropagation so semantically similar characters can receive nearby vectors.The learned representation clusters characters with related attributes, including uppercase and lowercase letters.
- Feature Detection: Convolutional filters detect local patterns for widths k ∈ {2, 3, 4, 5}, SumPool aggregates activations, and concatenation forms a 1024-length feature vector.The convolutional filters span the embedding dimension; the model uses t = 256 filters in each width-specific tower.
- Feature Detection: The convolutional representation supports approximate matching of semantically similar substrings rather than only exact character n-grams.Summed filter activations aggregate detected sequential patterns across the full string, allowing subsequences to occur anywhere.
- Regularization: Layer-wise normalization and dropout regularize the network because the unregularized model can readily overfit, even with millions of samples.Dropout is set to 0.5 generally and 0.2 for registry keys.
- Classification: A two-layer dense network maps extracted features to a sigmoid probability that the input string is malicious.The classifier uses l = 1024 units, while binary cross-entropy is minimized with Adam.
4 Results
eXpose is evaluated on malicious URLs, file paths, and registry keys using large datasets, ROC curves, and comparisons with hashed n-gram and expert-feature baselines. Convolutional feature extraction performs best overall, although file-path and registry-key results are weaker because labeling and data are more limited.
- Datasets: The evaluation covers malicious URL, file-path, and registry-key detection using datasets containing millions of artifacts.The datasets include 19,067,879 URLs, 5,590,614 file paths, and 1,661,716 registry key paths.
- Labeling: URL labels use voting across 59 antivirus engines, while file-path and registry-key labels are derived from malware-context occurrence patterns.URLs with 1–4 detections were discarded; artifacts occurring only in malicious contexts were labeled malicious.
- Baselines: The baselines use hashed 1–5-gram features, with an additional manually engineered URL-feature baseline, and feed 1024-dimensional vectors into an MLP.The MLP matches the neural model except that its learned feature-extraction layers are replaced by manually constructed features.
- Evaluation: Evaluation reports ROC curves and focuses on false-positive rates of 10^-4 and 10^-3 as deployment-relevant thresholds.The ROC measure is independent of the benign-to-malware ratio in the dataset.
- Results: 6% higher detection rate at FPR 10^-3 is achieved by eXpose than by n-gram or expert-derived features, with larger improvements on file paths and registry keys.Across the tested problems, convolutional feature extraction outperforms the other approaches.
- Limitations: File-path and registry-key results are worse than URL results because their labels can be difficult to estimate and their datasets contain less training data.The paper notes that sparse observations make zero-occurrence-based labeling uncertain and can reduce generalizability.
5 Conclusions
The paper presents eXpose as a convolutional neural network that learns classification-optimized features from short cybersecurity strings. It demonstrates this approach across several adversarial detection problems, while noting computational limits that prevented testing more complex architectures.
- Conclusions: eXpose uses character embeddings and convolutional layers with supervised end-to-end training to extract features optimized directly for classification.The paper describes this as automatic feature extraction from short strings in cybersecurity settings.
- Conclusions: The paper demonstrates eXpose on multiple cybersecurity problems involving deliberately obfuscated strings.The claimed contribution is adaptation of a top-to-bottom deep-learning method to several security detection tasks.
- Limitations: Training costs for longer strings prevented experimentation with more complex architectures.The authors suggest hardware and distributed training advances could enable further improvement.
- Future directions: The authors hope eXpose will support moving from expensive feature engineering toward end-to-end learning on existing labeled datasets.They expect the difference between automatic and traditional feature extraction to increase as hardware and datasets improve.
Appendix
The appendix defines the neural network’s reusable layers, including embeddings, convolutions, normalization, pooling, dropout, merging, dense ReLU units, and a sigmoid decision layer.
- Layers: Embedding(s, m) maps character indices into m-dimensional floating-point vectors for strings of length s.Each unique character is assigned an integer from the input alphabet before embedding.
- Layers: Conv(t, k, n) applies t one-dimensional convolution kernels of length k across adjacent embedding vectors, followed by ReLU activation.The convolution operates over n adjacent m-dimensional vectors.
- Regularization: BatchNorm performs layer-wise batch normalization, while Dropout(p) randomly drops units with probability p.Both are predefined network components described using Keras layers.
- Pooling: SumPool sums inputs across the string-length dimension, producing an output of size k from an input of size (s, k).The operation is implemented as a Keras Lambda function.
- Composition: Merge concatenates outputs from multiple preceding layers into a single matrix.The documented example merges outputs indexed as k1, k2, k3, and k4.
- Output layers: Dense(l) produces l fully connected ReLU-activated outputs, whereas DenseSigmoid produces the final binary decision.DenseSigmoid is equivalent to Dense(1) followed by sigmoid activation.