PaperlayerView exact revision on arXiv

Source-linked AI summary

Survey of Machine Learning Techniques for Malware Analysis

Daniele Ucci, Leonardo Aniello, Roberto Baldoni

arXiv:1710.08189v3cs.CR

TL;DR

The survey organizes literature on PE malware analysis through machine learning according to proposed taxonomies and provides a detailed comparative analysis. It also identifies malware analysis economics as a novel concept and notes ground-truth and anti-analysis challenges.

  • Problem

    Machine learning techniques are hindered by a lack of ground truth for malware attribution.

  • Method

    The survey arranges existing PE malware-analysis literature through machine learning according to a proposed taxonomy.

  • Results

    The survey provides a detailed comparative analysis of surveyed works and covers objectives and features such as malware attribution and triage.

  • Takeaways & Limitations

    The work introduces malware analysis economics as a novel concept for studying trade-offs among analysis metrics and economical costs.

  • Takeaways & Limitations

    The survey highlights anti-analysis techniques used by malware and the choice of operation set as issues in malware analysis.

Abstract

from arXiv · show

Coping with malware is getting more and more challenging, given their relentless growth in complexity and volume. One of the most common approaches in literature is using machine learning techniques, to automatically learn models and patterns behind such complexity, and to develop technologies to keep pace with malware evolution. This survey aims at providing an overview on the way machine learning has been used so far in the context of malware analysis in Windows environments, i.e. for the analysis of Portable Executables. We systematize surveyed papers according to their objectives (i.e., the expected output), what information about malware they specifically use (i.e., the features), and what machine learning techniques they employ (i.e., what algorithm is used to process the input and produce the output). We also outline a number of issues and challenges, including those concerning the used datasets, and identify the main current topical trends and how to possibly advance them. In particular, we introduce the novel concept of malware analysis economics, regarding the study of existing trade-offs among key metrics, such as analysis accuracy and economical costs.

1. Introduction

The survey reviews machine learning for Windows Portable Executable malware analysis and systematizes prior work by objectives, features, and algorithms. It also identifies challenges, research trends, benchmark guidance, and trade-offs among accuracy, time, and cost.

  • The survey focuses on machine learning methods supporting malware analysis of Windows Portable Executables.
  • 64 recent papers are organized by analysis objective, PE feature type, and machine learning algorithm.
  • The taxonomy distinguishes malware detection, malware similarity analysis, and malware category detection.
  • PE features are grouped into eight types, including byte sequences, APIs/System calls, opcodes, network, file system, CPU registers, PE characteristics, and strings.
  • The survey highlights unresolved issues involving anti-analysis techniques, behavior modeling, and obsolete or unavailable datasets affecting significance and reproducibility.
  • It proposes benchmark guidelines, identifies trends such as malware attribution and triage, and introduces malware analysis economics for accuracy, time, and cost trade-offs.

2. Related Work

Prior surveys examine subsets of machine-learning malware research, often emphasizing detection, selected features, or particular applications. This survey broadens the scope to multiple objectives, more feature types, distinct issues, and malware analysis economics.

  • Earlier surveys commonly focus on malware detection, whereas this survey also covers similarity analysis and category detection.
  • The survey introduces malware economics as a novel contribution not mentioned by the related work discussed.
  • The survey differs from related work by jointly organizing papers according to objectives, features, and machine learning techniques.
  • Compared with detection-focused reviews, this survey considers a broader set of PE feature types, including strings, file systems, and CPU registers.
  • Its identified issues and limitations complement earlier discussions centered on incremental, active, and adversarial learning.
  • Unlike reviews of malware development or evasion, this work examines machine learning that supports malware analysis even when evasion techniques are used.

3. Taxonomy of Machine Learning Techniques for Malware Analysis

The proposed taxonomy organizes machine-learning malware-analysis papers along three dimensions: the analysis objective, the extracted and considered features, and the algorithm type.

  • The taxonomy organizes surveyed works along three major dimensions.These dimensions are objective, features, and machine learning algorithm.
  • The objective dimension captures the final purpose of the analysis, such as malware detection.
  • The feature dimension records how features are extracted and which features are considered, such as CPU registers.
  • The algorithm dimension identifies the learning type used for analysis, such as supervised learning.
  • Figure 1 provides a graphical representation of the taxonomy.

3.1. Malware Analysis Objectives

The surveyed malware-analysis objectives are detection, similarity analysis, and category detection. These goals support blocking malicious samples, recognizing related malware, focusing investigation on novel content, and adding behavioral information.

  • The taxonomy identifies malware detection, malware similarity analysis, and malware category detection as three main objectives.
  • Malware detection: Malware detection determines whether a sample is malicious and is the most common objective among reviewed works.
  • Malware detection: Detection outputs may include confidence values that help analysts decide whether a sample needs further inspection.
  • Malware similarity analysis: Similarity analysis includes variants, families, similarities, and differences detection.
  • Malware similarity analysis: Recognizing variants can prevent reuse-based evasion and help explain malware evolution over time.
  • Malware similarity analysis: Similarity detection helps analysts focus on what is new, while family detection associates unknown samples with known families and supplies information for further analysis.
  • Malware category detection: Category detection uses coarse-grained behavioral or objective-based categories such as spyware, ransomware, and remote access toolkits.
  • Malware category detection: A standardized taxonomy of malware categories is not yet established, although recognizing categories can add valuable analysis information.

3.2. Malware Analysis Features

The survey organizes malware-analysis features by how they are extracted and by the executable information they represent, spanning static, dynamic, and hybrid analysis. Feature classes include code, behavior, environment interactions, and PE metadata.

  • Feature extraction: Dynamic analysis commonly generates execution traces, while program-analysis tools provide disassembly code and control- and data-flow graphs.Accurate disassembly supports byte-sequence and opcode extraction; graphs can support API and system-call extraction.
  • Feature extraction: Feature extraction uses static analysis, dynamic analysis, or a combination of both, depending on the features considered.Static analysis examines samples without execution; dynamic analysis runs samples to examine behavior.
  • Portable executable features: Byte sequences represent recurring binary n-byte combinations, with most specified n-gram sizes no longer than 3.The number of possible combinations grows exponentially with n.
  • Portable executable features: Opcodes capture machine-level operations through individual or sequential opcode features, extracted from assembly or execution.Some studies aggregate opcode occurrences by operation type, such as mathematical or memory-access instructions.
  • Portable executable features: Behavioral features include APIs and system calls, network activity, file-system and Registry operations, and CPU-register use.These features describe actions, operating-system interaction, persistence-related activity, contacted infrastructure, and stored register values.
  • Portable executable features: Other surveyed features include control-flow graphs, PE characteristics, strings, and selected byte chunks or binary content.PE characteristics include sections, imports, symbols, and used compilers.

3.3. Malware Analysis Algorithms

The survey classifies reviewed machine-learning algorithms according to supervised, unsupervised, and semi-supervised learning. The reviewed literature spans rule-based, tree, neighbor, neural, clustering, and similarity-based methods.

  • Algorithm taxonomy: The algorithm survey is organized by supervised, unsupervised, and semi-supervised learning.This classification reflects whether learning uses labeled examples, unlabeled data, or both.
  • Supervised learning: Supervised learning trains statistical models with correct instance examples during a preliminary training phase.Reviewed algorithms include rule-based methods, decision trees, Logistic Model Trees, k-Nearest Neighbors, and Multilayer Perceptron Neural Networks.
  • Unsupervised learning: Unsupervised approaches learn directly from unlabeled data without a training phase.Reviewed methods include locality-sensitive-hashing clustering, distance or similarity metrics, DBSCAN, hierarchical and prototype-based clustering, and Self-Organizing Maps.

imization [54], k-Means Clustering [43, 54], k-Medoids [45], Density-based Spa-

The survey also covers unsupervised and semi-supervised approaches, including several clustering strategies and methods that combine labeled with unlabeled data.

  • Unsupervised learning: Reviewed unsupervised methods include DBSCAN, hierarchical clustering, prototype-based clustering, Self-Organizing Maps, k-Means, and k-Medoids.The survey also lists Euclidean, Hamming, cosine, and Jaccard distance or similarity measures.
  • Semi-supervised learning: Semi-supervised learning combines labeled and unlabeled data to train statistical models.Reviewed examples use Learning with Local and Global Consistency and Belief Propagation.

4. Characterization of Surveyed Papers

The survey characterizes papers by analysis objective, features, algorithms, datasets, and labeling, then uses this taxonomy to identify literature gaps and research directions. It highlights both recurring feature choices and dataset reproducibility problems.

  • Characterization dimensions: The characterization records each paper’s analysis objective, machine-learning algorithm, features, dataset source and availability, labels, and benign, malicious, and total sample counts.The tables organize these attributes across surveyed studies.
  • Datasets and reproducibility: Many studies fail to specify which dataset samples were selected, preventing reproduction of their results.The survey identifies this as a dataset-reporting problem in its characterization.
  • Malware detection: Malware-detection studies most commonly use byte sequences and dynamically derived API or system-call invocations, often comparing multiple algorithms.The stated purpose is to identify the algorithm producing more accurate results.
  • Malware similarity analysis: Similarity-analysis studies widely use APIs and system calls together with memory, file-system, and CPU-register interactions.Differences-detection studies generally omit hosting-system interactions, whereas similarity-detection studies include them.
  • Malware category detection: Category-detection studies focus on threats using features such as byte sequences, opcodes, function lengths, and network activity.The reviewed category-detection works are reported in a dedicated table.
  • Gaps and research directions: Reasoning across objectives, features, and algorithms enables the survey to identify literature gaps and possible research directions.For differences detection, it specifically points to adding memory, file-system, CPU-register, and Windows Registry features beyond dynamically extracted APIs and system calls.

5. Issues and Challenges

The surveyed literature faces challenges from malware anti-analysis techniques, feature and operation-set choices, and weaknesses in evaluation datasets. These issues constrain analysis reliability and motivate better benchmarks and analysis methods.

  • Anti-analysis techniques: Obfuscation, packing, and encryption hinder static analysis, while runtime deobfuscation, unpacking, or decryption may be needed to execute concealed payloads.The surveyed challenges include discovering configuration storage and identifying standard or custom concealment algorithms.
  • Anti-analysis techniques: Anti-analysis techniques, including environmental awareness, timing-based evasion, and interaction requirements, can prevent malware from revealing malicious behavior.Dynamic analysis may expose hidden information, but more advanced techniques can remain effective against controlled execution environments.
  • Features and operation sets: Considering only a subset of operations reduces computational complexity but can lower behavioral-model accuracy and analysis reliability.Disassembly and decompilation errors can also negatively affect the overall analysis, motivating tools that improve generated code quality.
  • Datasets: The survey proposes benchmarks labeled for their objectives, reflecting realistic sample distributions, and actively updated with temporal information.For malware detection, the benchmark should include legitimate applications because they are orders of magnitude more numerous than malware samples.

6. Topical Trends

The survey identifies emerging directions in malware analysis, including mining online submissions, attribution, triage, evolution prediction, and underused behavioral features. These areas remain limited by sparse evidence, unavailable ground truth, or unresolved effectiveness questions.

  • Online analysis services: Online malware-analysis services can provide additional features and intelligence about samples, including submission time and antivirus classifications.Public submissions have also included samples associated with infamous targeted campaigns, suggesting their potential relevance for analysis.
  • Malware attribution: Malware attribution research is hindered by the lack of reliable ground truth about malware authors and requires alternative ways to generate it.Potential attribution features include programming language, embedded network indicators, coding style, communication timing, and digital certificates.
  • Malware triage: Malware triage requires balancing accuracy and performance so analysts can prioritize samples for deeper analysis.Similarity to previously analyzed binaries can inform whether a new sample deserves further examination, while faster triage may come at the cost of worse accuracy.
  • Malware evolution prediction: Machine learning for malware evolution prediction is a promising but sparsely investigated direction for anticipating future malware variants.The survey notes that only a couple of works appear to address this topic and frames prediction as an objective in its malware-analysis taxonomy.
  • Additional features: Underused features such as memory accesses, function length, and raised exceptions warrant further study for improving machine-learning accuracy.Function length alone is insufficient to distinguish malicious from benign executables and is typically combined with other static or dynamic features.

7. Malware Analysis Economics

Malware analysis economics studies trade-offs among accuracy, execution time, throughput, computational resources, and cost. A qualitative example shows how feature choices and parallelism affect whether accuracy and processing-load requirements can be met.

  • Concept: Malware analysis economics examines trade-offs between analysis quality and the equipment, computation, storage, and network resources required.The paper introduces the concept as a qualitative framework for studying these relationships.
  • Feature extraction: Dynamic feature extraction is more time-consuming than static extraction but can provide features that contribute substantially to analysis effectiveness.The choice between static and dynamic extraction affects both execution time and analysis accuracy.
  • Trade-offs: Higher accuracy can require longer execution times, slower analysis pace, more computational resources, and greater economic cost.The survey also identifies analogous space-complexity trade-offs, including feature spaces that can grow exponentially with n for n-grams.
  • Implications: The survey calls for more detailed investigation of these trade-offs to guide analysis-environment design under accuracy, pace, and budget requirements.The presented example is intended to explain how malware analysis economics can be applied to practical scenarios.

8. Conclusion

The survey organizes machine-learning research on PE malware analysis by objectives, features, and algorithms, then identifies issues, trends, and trade-offs that motivate future work.

  • Conclusion: The survey systematizes PE malware-analysis literature across objectives, extracted feature types, and machine-learning algorithms.This organization provides an overview of how algorithms and feature classes support analysis objectives.
  • Conclusion: The comparative analysis highlights current issues involving malware anti-analysis techniques, feature-operation sets, and datasets.These issues are presented as areas requiring further investigation.
  • Conclusion: The survey identifies topical trends including malware attribution and triage, alongside possible research directions involving new objective-feature-algorithm combinations.It also notes that unused algorithm classes for particular objectives may suggest directions for further examination.
  • Conclusion: Malware analysis economics studies trade-offs among analysis performance metrics, such as accuracy and execution time, and economical costs.The concept can support tuning strategies that balance competing metrics when designing a malware-analysis environment.
  • Conclusion: Defining appropriate malware-analysis benchmarks is identified as a priority for the research area.The authors connect this priority to the need for advancing research directions.
Loading 1710.08189v3…