PaperlayerView exact revision on arXiv

Source-linked AI summary

Early Stage Malware Prediction Using Recurrent Neural Networks

Matilda Rhode, Pete Burnap, Kevin Jones

arXiv:1708.03513v3cs.CR

TL;DR

Static malware detection is fast but vulnerable to obfuscation and unseen code, whereas dynamic data are more robust but usually take too long to collect. The paper uses an ensemble of recurrent neural networks on early machine-activity data and reports accurate malicious-versus-benign prediction within seconds, while noting portability and adversarial-startup limitations.

  • Problem

    The paper addresses whether short snapshots of behavioural data can predict malicious executables before conventional dynamic analysis finishes.

  • Method

    The method feeds early machine-activity data into an ensemble of recurrent neural networks to classify files as malicious or benign.

  • Results

    94% detection accuracy was achieved with 5 seconds of dynamic data, and 96% accuracy in less than 10 seconds.

  • Takeaways & Limitations

    The results support developing endpoint methods that predict and block malicious files before payload execution is complete.

  • Takeaways & Limitations

    Portability across machines was not tested, and adversaries could evade a fixed first-5-seconds detector by inserting sleeps or benign startup behaviour.

Abstract

from arXiv · show

Static malware analysis is well-suited to endpoint anti-virus systems as it can be conducted quickly by examining the features of an executable piece of code and matching it to previously observed malicious code. However, static code analysis can be vulnerable to code obfuscation techniques. Behavioural data collected during file execution is more difficult to obfuscate, but takes a relatively long time to capture - typically up to 5 minutes, meaning the malicious payload has likely already been delivered by the time it is detected. In this paper we investigate the possibility of predicting whether or not an executable is malicious based on a short snapshot of behavioural data. We find that an ensemble of recurrent neural networks are able to predict whether an executable is malicious or benign within the first 5 seconds of execution with 94% accuracy. This is the first time general types of malicious file have been predicted to be malicious during execution rather than using a complete activity log file post-execution, and enables cyber security endpoint protection to be advanced to use behavioural data for blocking malicious payloads rather than detecting them post-execution and having to repair the damage.

1. Introduction

The paper targets malware detection gaps caused by static-analysis weaknesses and dynamic-analysis delay by predicting maliciousness from early execution behaviour. It proposes recurrent neural networks and reports accurate detection within seconds, including unseen variants and ransomware.

  • Motivation: Rapidly rising malware volume makes automatic detection necessary for endpoint systems.VirusTotal approaches one million new, distinct files for analysis each day.
  • Limitations of existing detection: Static signature filtering can miss zero-day malware and obfuscated samples that evade code-based matching.Static detection depends on overlap with previously known strains.
  • Limitations of existing detection: Behavioural analysis is more resilient than static analysis but incurs a substantial execution-time penalty and can create operational detection problems.Live monitoring may miss new malware types, while anomaly detection can generate false positives and overwhelm human analysts.
  • Proposed approach: The paper proposes recurrent neural networks using the first few seconds of machine activity to predict whether files are malicious.The authors position this as an early attempt to predict malicious behaviour across various malware types from early-stage activity.
  • Reported findings: 94% accurate benign-versus-malicious detection was achieved 5 seconds into execution using an ensemble of recurrent neural networks.Previous dynamic-analysis research collected data for around 5 minutes per sample.
  • Reported findings: 94% accuracy was reported at 1 second for 3,000 ransomware samples without prior exposure to ransomware examples.The case study also investigates which feature combinations most influence model decisions.

2. Related Work

Related work contrasts static and dynamic malware detection, reviews time-efficiency strategies, and motivates recurrent networks for sequential behavioural data. It also situates the paper's ransomware focus within recovery-sensitive detection problems.

  • Static and hybrid detection: Static and behaviour-based malware features each offer benefits and drawbacks, motivating continued exploration of both approaches.Hybrid methods combine both sources but can retain static-analysis weaknesses when they depend on static filtering beyond known malware.
  • Static and hybrid detection: Static detection is fast but can lose effectiveness on obfuscated or unseen malware, while reported code-based models show performance variation across data conditions.The supplied related-work passage reports a true-positive rate of 95.2% that falls to 67.7% under a different training condition.
  • Dynamic detection: Dynamic malware studies commonly use API-call sequences and report strong classification metrics, but typically analyse longer behavioural traces.The reviewed studies include RNN, convolutional, decision-tree, Naive Bayes, and Random Forest approaches.
  • Time-efficient dynamic analysis: Time-efficiency methods reduce dynamic-analysis cost by stopping collection early or selectively applying dynamic analysis to samples unlike known malware.One cited approach reduced total time by 67% relative to 15-minute conventional analysis.
  • RNN-based detection: RNNs are proposed for malware detection because they process time-series data and capture feature changes over time.Prior work also applied recurrent networks and LSTMs to malware-family classification using API-call sequences.
  • Ransomware detection: Ransomware is a salient early-detection target because recovery can be difficult or costly after files are encrypted.The paper tests its model on a corpus of 3,000 ransomware samples.

3. Methods

The method uses short sequences of machine-activity measurements from sandboxed execution and recurrent neural networks to model temporal behaviour. Hyperparameters are selected through random search for repeated retraining and optimisation.

  • Design rationale: The model uses short sequences of initial dynamic data to test whether maliciousness can be judged accurately within seconds.The approach seeks to retain dynamic analysis's robustness to obfuscation while reducing collection time.
  • Input data: Ten machine-activity metrics are sampled every second for 20 seconds, producing progressively longer input sequences during execution.At 1 second, the sequence contains two feature sets.
  • Input data: The activity data are collected by executing Portable Executable samples in Cuckoo Sandbox and extracting metrics with a Psutil-based auxiliary module.Metrics include CPU, network, memory, swap, process-count, and process-ID measurements.
  • Model: RNNs are selected because they model sequential changes, including both feature values and their rates and directions of change.The paper contrasts them with Hidden Markov Models and argues that RNNs better handle large state spaces and extended event chains.
  • Model: LSTM cells help RNNs retain or forget information when relevant, mitigating problems that previously harmed classification of long sequences.The passage describes vanishing or exploding weight updates in earlier RNNs.
  • Training and optimisation: Random search is used to automate hyperparameter selection because it can be parallelised and repeated as malware and model requirements evolve.The paper anticipates regular retraining with newly discovered samples.

4. Dataset

The dataset combines labeled Windows executables from VirusTotal, system files, and popular software sources, with temporally separated evaluation data and a separate ransomware case study. Input features capture machine activity and are normalized before modeling.

  • Samples: Samples included VirusTotal executables, fresh Windows 7 system files, and 4,000 Windows 7 applications downloaded from popular free-software sources.Downloaded applications were included to better represent typical anti-virus workloads than Windows system files alone.
  • Labels: Malware labels required detection by at least 5 VirusTotal engines, while files detected by none were treated as trusted.Files detected by fewer than 5 engines were omitted because their labels were considered contentious.
  • Samples: 2,345 benign and 2,286 malicious samples formed the final dataset, with 2,876 additional ransomware samples reserved for a case study.The ransomware samples came from the VirusShare online malware repository.
  • Evaluation split: Training and test files were split by VirusTotal first-seen date to mimic evaluation on completely new software.Training used files seen before 10 October 2017, while testing used files seen afterward.
  • Malware composition: The study catalogued malware families, variants, APTs, and ransomware, removing ransomware from training for the ransomware case study.A disputed class covered malware without a majority family assignment from the anti-virus engines.
  • Input features: The 10 machine-activity inputs showed similar interquartile ranges but different outlier patterns between benign and malicious samples.Benign samples had more RAM-use and received-packet outliers, whereas malicious samples had more total-process outliers.
  • Preprocessing: Features were normalized around the training data’s zero mean and unit variance before training to improve convergence speed.The normalization kept values within the numeric range used by the model’s neurons.

5. Experimental Results

The experiments show that recurrent neural networks generalize better than other tested algorithms on unseen files, achieving strong early malware detection. Results across unseen families, variants, ransomware, feature analyses, and ensembles indicate high early accuracy but expose dependence on recognizable activity patterns and input features.

  • 5.2. Predicting malware using early-stage data: The RNN achieved the highest accuracy on unseen test files after 1 second and consistently outperformed other algorithms thereafter.Using 4 seconds of data, it classified 91% of unseen samples correctly; accuracy reached 96% at 19 seconds.
  • 5.3. Simulation of zero-day malware detection: Every tested malware variant exceeded 89% accuracy during its first second despite being absent from training, while families generally achieved lower accuracy.The authors attribute early variant performance to shared delivery mechanisms and note that Trojans performed worse than random chance during the first few seconds.
  • 5.4. Ransomware Case Study: 94% accuracy was achieved for ransomware at 1 second without prior ransomware examples, increasing to 99.86% when half the ransomware samples were included in training.Without relevant-family exposure, accuracy dropped after the initial seconds, whereas training with half the samples maintained high accuracy later.
  • 5.3. Simulation of zero-day malware detection: The model’s unseen-family accuracy supports the presence of shared dynamic characteristics, especially infection mechanisms that help distinguish malware from benignware early.The paper argues that new delivery mechanisms are less common than new variants, making them useful for early detection.
  • 5.4. Ransomware Case Study: CPU usage had the highest impact factor at 4 seconds, while turning on only two packet-related features still enabled models to beat 50% accuracy.The feature analysis also indicates that an adversary aware of this dependence might manipulate CPU usage to evade detection.

6. Limitations and Future work

The proposed early behavioural detector has practical boundaries involving adversarial evasion, platform scope, process response, and machine-specific calibration. Future work targets sliding-window monitoring, broader file and operating-system coverage, endpoint deployment, and robustness evaluation.

  • Scope: The evaluation covers only Windows 7 executables, so applicability to PDFs, URLs, other malware vehicles, and other operating systems remains untested.The authors identify broader file-type and platform evaluation as a future direction.
  • Robustness to adversarial samples: Adversaries could evade first-5-second detection by inserting long sleeps or benign initial behaviour, motivating sliding-window prediction.The authors hypothesize that malicious files begin their objectives quickly, but expect this assumption to change if attackers know the detection window.
  • Future work: A sliding-window system would take repeated five-second snapshots during live execution, eliminating waiting before file access but requiring endpoint recalibration.Implementation also requires sufficiently quick termination after malicious activity is detected.
  • Robustness to adversarial samples: The authors argue that adversarial adaptation would not invalidate the method because many malware samples would remain without benign behaviour injected at startup.They propose evaluating robustness using adversarially crafted samples.
  • Deployment challenges: Behavioural data can indicate maliciousness from initial activity, but endpoint deployment requires rapid process termination before payload execution.The proposed live-monitoring approach still needs evaluation of whether predicted malicious processes can be blocked in time.
  • Portability to other machines and operating systems: Training data is not yet shown to transfer across machines because relative metrics, hardware capacity, and measurement granularity can differ.The authors propose recalibration on the target machine, while noting that low resource granularity could make distinct behaviours appear identical.

7. Conclusions

The paper addresses the vulnerability of static detection to obfuscation and the latency of conventional dynamic analysis by using recurrent neural networks on early execution behaviour. It reports accurate detection within seconds, including unseen variants, and positions the approach for future endpoint integration across platforms.

  • Conclusions: Dynamic detection avoids static-analysis susceptibility to code obfuscation but traditionally waits for a complete execution footprint before deciding maliciousness.The paper frames this delay as a central motivation for prediction during execution.
  • Conclusions: RNNs reduce dynamic detection time to less than 5 seconds per file while retaining the advantages of behavioural analysis.The stated application is predicting and blocking malicious files before complete payload execution.
  • Conclusions: 94% accuracy was achieved with 5 seconds of dynamic data, and 96% accuracy in less than 10 seconds, compared with around 5 minutes for typical dynamic analysis.These results quantify the reduction in observation time reported by the experiments.
  • Conclusions: Bidirectional hidden layers were present in the best randomly searched RNN configurations, suggesting that processing features forward and backward aided behavioural distinction.This is the configuration pattern identified by the authors among the best networks.
  • Conclusions: The work is presented as the first analysis predicting general malware executables during execution rather than from complete post-execution logs.The authors anticipate future integration of file-specific behavioural detection into endpoint antivirus systems across operating systems.
Loading 1708.03513v3…