PaperlayerView exact revision on arXiv

Source-linked AI summary

AVClass2: Massive Malware Tag Extraction from AV Labels

Silvia Sebastián, Juan Caballero

arXiv:2006.10615v2cs.CR

TL;DR

AV labels contain useful information beyond family names, but vendor-specific vocabularies make consistent extraction challenging. AVClass2 extracts broader tags using an open taxonomy and an update module; evaluation on 42M samples reported richer searches and tags complementary to those used by popular repositories.

  • Problem

    AV labels use inconsistent vendor vocabularies, and existing family-labeling approaches do not extract all the useful class, file-property, and behavior information they contain.

    Source: §1 · p. 1

  • Method

    AVClass2 extracts malware tags with an open taxonomy and uses co-occurrence relations to propose taxonomy, tagging-rule, and expansion-rule updates.

    Source: §1 · p. 2, §4 · p. 6

  • Results

    Evaluation on 42M samples reported that AVClass2 enables rich searches, produces tags complementary to those in popular malware repositories, and supports maintaining an updated knowledge base.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Extracted tags can enhance searches for samples of interest and support using identified samples as ground truth for machine-learning approaches.

    Source: §7 · p. 11

    Manual examination of update quality is subjective and may not identify all errors.

    Source: §5.3 · p. 8

Abstract

from arXiv · show

Tags can be used by malware repositories and analysis services to enable searches for samples of interest across different dimensions. Automatically extracting tags from AV labels is an efficient approach to categorize and index massive amounts of samples. Recent tools like AVClass and Euphony have demonstrated that, despite their noisy nature, it is possible to extract family names from AV labels. However, beyond the family name, AV labels contain much valuable information such as malware classes, file properties, and behaviors. This work presents AVClass2, an automatic malware tagging tool that given the AV labels for a potentially massive number of samples, extracts clean tags that categorize the samples. AVClass2 uses, and helps building, an open taxonomy that organizes concepts in AV labels, but is not constrained to a predefined set of tags. To keep itself updated as AV vendors introduce new tags, it provides an update module that automatically identifies new taxonomy entries, as well as tagging and expansion rules that capture relations between tags. We have evaluated AVClass2 on 42M and showed how it enables advanced malware searches and to maintain an updated knowledge base of malware concepts in AV labels.

1 INTRODUCTION

AV labels use inconsistent vendor vocabularies, and family-labeling tools leave other useful information in those labels unextracted. AVClass2 addresses this by extracting broader malware tags and supporting an open, updateable taxonomy.

1 INTRODUCTION

  • AVClass2 extends family-focused extraction because AV labels also contain useful class, file-property, and behavior information.AVClass and Euphony had demonstrated extraction of family tags despite label noise.Source: §1 · p. 1
  • Automatic extraction can categorize and index samples without waiting for static analysis or sandbox execution.Extracted tags can support searches and provide identified samples as ground truth for machine-learning approaches.Source: §1 · p. 1
  • AV engines use inconsistent vocabularies, making equivalent concepts difficult to find across labels.For example, multiplug and brappware both refer to samples that modify browsers by installing plugins.Source: §1 · p. 1
  • AVClass2 extracts tags for malware class, family, file properties, and behaviors without requiring a predefined closed set.Unknown tags are considered, and an update module uses co-occurrence relations to propose taxonomy, tagging-rule, and expansion-rule updates.Source: §1 · p. 2
  • 42M samples were used to evaluate AVClass2 against AVClass and Euphony, with reported support for richer searches and an updated knowledge base.The extracted tags are also reported as complementary to tags used by popular repositories such as VirusTotal.Source: §1 · p. 2

2 OVERVIEW

AVClass2 combines a labeling module that produces ranked tags with an update module that proposes changes to its rules and taxonomy. Its open taxonomy and token handling accommodate concepts not yet represented in the current configuration.

2 OVERVIEW

  • The overview separates labeling, which outputs tags ranked by supporting AV engines, from updating, which proposes rule and taxonomy changes.The labeling module can use default or analyst-provided tagging rules, expansion rules, and taxonomy.Source: §2 · p. 2

2.1 Labeling Module Overview

  • Tagging maps tokens to taxonomy concepts, aliases multiple vendor tokens to one concept, and discards tokens designated as generic.Rules should map tokens to the most specific tags; unknown tokens are kept for expansion rather than discarded.Source: §2.1 · p. 3
  • Expansion makes implied concepts explicit using taxonomy parent-child relationships and inter-category rules.Rules can be supplied by analysts or identified by the update module, and can increase search coverage.Source: §2.1 · p. 3

2.2 Taxonomy

  • The taxonomy organizes tags beneath behavior, class, file-property, and family categories, while unknown concepts can remain in an open taxonomy.AVClass2 assumes the taxonomy is incomplete and can retain unknown tokens under an UNK pseudo-category for later refinement.Source: §2.2 · pp. 3–4

2.3 Update Module Overview

  • Because malware concepts and relations evolve, manual updates do not scale; the update module uses co-occurrence and learning rules to propose changes.The proposed changes cover taxonomy entries, tagging rules, and expansion rules.Source: §2.3 · p. 5

3 LABELING MODULE

The labeling module processes AV labels through tokenization, tagging, and expansion, then ranks retained tags and unknown tokens by their support across engines. Its running example illustrates the successive transformations.

3 LABELING MODULE

  • Tokenization splits each AV label into tokens and retains short tokens until after tagging.This allows short tokens corresponding to concepts such as irc and bot to be recognized.Source: §3 · p. 5
  • Tagging applies rules to replace tokens with tags, removes generic or short tokens, and retains tokens with no matching rule as unknown.In the running example, win becomes windows, risktool becomes grayware and tool, and trojan is dropped as generic.Source: §3 · p. 5
  • Expansion applies inter-category rules before implicit taxonomy parent-child relationships, while leaving unknown tokens unchanged.For example, bitcoinminer implies the CLASS:miner tag.Source: §3 · p. 5
  • Tags and unknown tokens are ranked by the number of AV labels containing them, and those found in at most one engine's label are removed.AVClass2 can also output the highest-ranked family tag or unknown token in compatibility mode.Source: §3 · p. 5

4 UPDATE MODULE

The update module uses co-occurrence statistics to identify strong relations, then recursively turns them into taxonomy, tagging-rule, and expansion-rule updates.

4 UPDATE MODULE

  • The update process first generates co-occurrence statistics during labeling, then identifies strong relations and converts them into updates to the input files.The novel component is the recursive process and update rules that generate taxonomy, tagging-rule, and expansion-rule updates.Source: §4 · p. 5
  • A relation is strong when both tags occur in at least 20 samples and their conditional co-occurrence is at least 0.94; implications can be one-way or mutual.The thresholds are the empirically selected AVclass defaults.Source: §4 · p. 6
  • Across iterations, already-known relations are removed, while unknown-tag relations can add aliases or taxonomy entries and equivalent tags produce tagging rules.Relations are checked against the evolving taxonomy and rules because earlier updates can make later relations known.Source: §4 · p. 6
  • After recursion ends, remaining rules are examined for expansions that capture family properties or class-associated behaviors and file properties.Expansion rules are applied once the taxonomy and tagging rules are stable.Source: §4 · p. 6
  • Twelve of 25 category pairs have no rule; they account for less than 1% of relations and are considered likely collisions best resolved manually.The five categories, including UNK, yield 25 possible pairs.Source: §4 · p. 6
  • The final output is updated taxonomy, tagging, and expansion rules, and some original taxonomy entries or tagging rules may be modified or removed.Source: §4 · p. 6

5 EVALUATION

The evaluation tests AVclass2 across 11 datasets, measuring tag coverage, update-module outputs, advanced search uses, and family-labeling performance against prior tools. It finds broad tag coverage and useful taxonomy updates, while family-only labeling remains a faster use case for AVclass.

5.1 Datasets

  • The evaluation uses 11 datasets spanning Windows and Android samples, family-label availability, sample counts, binary availability, and collection periods.Some datasets overlap, and the authors use available VirusTotal reports because rate limits make collecting the latest reports infeasible.Source: §5.1 · p. 7, Table 3 · p. 7

5.2 Tagging Evaluation

  • AVclass2 extracts at least one tag for 89%–100% of samples across datasets and tags at least 99% of samples flagged by four or more AV engines.In the Superset, tagged samples include file properties (99%), malware classes (94%), known families (83%), and behaviors (75%); the four-engine threshold is used to remove potentially benign samples.Source: §5.2 · p. 7, Table 4 · p. 7
  • In the Superset, the most prevalent tags include FILE:OS:windows (61%), CLASS:grayware (46%), and BEH:execdownload (27%).The taxonomy has 32–95 tags in each non-family category and 894 families; 94%–100% of taxonomy tags appear in the Superset. Intermediate tags such as packed accumulate the popularity of child tags, while behavior tags can cover samples without their associated class tag.Source: §5.2 · pp. 7–8

5.3 Update Module

  • On Andropup, the update module reduced samples with an unknown tag from 65% to 16%, and identified 486 taxonomy entries, 216 tagging rules, and 461 expansion rules.Of the 486 new taxonomy entries, 97% are new families; 96% of 968 strong relations involved an unknown token, with the analysis using n=20 and T=0.94.Source: §5.3 · p. 8
  • Manual review found that 11 of 1,163 updates (0.9%) required adjustment, and the authors describe that review as subjective and potentially incomplete.Three strong relations remained without generated updates and required analyst decisions; examining relations also exposed seed-taxonomy homonyms that could be corrected.Source: §5.3 · pp. 8–9

5.4 Beyond Family Labeling

  • The 975 tags in the Superset support searches by class, behavior, file property, and family, and complement tags already used by VirusTotal.The authors report that AVclass2 tags enable searches not currently possible through VirusTotal tags, including searches for particular classes or families and richer file properties and behaviors.Source: §5.4 · p. 9
  • AVclass2’s taxonomy and rules form a publicly available malware knowledge base that captures relations beyond individual samples and can be refined over time.The authors contrast its well-defined, vendor-independent methodology with existing online malware encyclopedias.Source: §5.4 · p. 9

5.5 Family Labeling Comparison

  • AVclass2 and AVclass* achieve the highest family-labeling F1 on four of five datasets, while AVclass ranks first on Malheur; AVclass is 7x–34x faster than Euphony.AVclass2 and AVclass* have the same accuracy when using the same input knowledge; AVclass2 is slower because it extracts additional tags.Source: §5.5 · p. 9, Table 7 · p. 10

6 RELATED WORK

Prior work documents disagreement and temporal change in AV labels, while existing tools have focused on extracting family names. AVclass2 extends this line by extracting broader tags through an open taxonomy that supports updates.

Malware labeling

  • AV engines disagree on labels, and selectively trusted samples can bias clustering evaluation toward easier cases.AV labels also change over time as signatures and analysis are refined.Source: §6 · p. 10
  • AVclass and Euphony use co-occurrence to identify family aliases, but differ in whether learned relations are reusable and how AV-engine structure is handled.AVclass reuses aliases and generic tokens across datasets; Euphony identifies aliases within a dataset and learns label structure from selected engines.Source: §6 · p. 10

Malware tagging

  • Unlike family-labeling tools, AVclass2 extracts malware classes, file properties, and behaviors in addition to families.This information can categorize and index malware samples.Source: §6 · p. 10
  • Compared with Ducau et al. [8]'s 11 predefined tags, AVclass2 uses an open taxonomy, handles tag aliases, supports updates, and does not limit supported AV engines.The taxonomy currently contains 150 non-family tags.Source: §6 · pp. 10–11

7 CONCLUSION

AVclass2 extracts tags across several malware dimensions from AV labels using an open taxonomy and an update module. The paper reports evaluating it on 42M samples.

7 CONCLUSION

  • AVclass2 extracts clean tags for malware class, family, file properties, and behaviors from AV labels using an open taxonomy.The taxonomy organizes concepts without constraining the tool to a predefined set of tags.Source: §7 · p. 11
  • Its update module uses tag co-occurrence to identify taxonomy updates automatically, while tagging and expansion rules capture relations between tags.The module is intended to support updates as AV vendors introduce new tags.Source: §7 · p. 11
  • AVclass2 was evaluated on 42M samples.Source: §7 · p. 11
Loading 2006.10615v2…