DeepAI
Log In Sign Up

Learning Explainable Representations of Malware Behavior

06/23/2021
by   Paul Prasse, et al.
0

We address the problems of identifying malware in network telemetry logs and providing indicators of compromise – comprehensible explanations of behavioral patterns that identify the threat. In our system, an array of specialized detectors abstracts network-flow data into comprehensible network events in a first step. We develop a neural network that processes this sequence of events and identifies specific threats, malware families and broad categories of malware. We then use the integrated-gradients method to highlight events that jointly constitute the characteristic behavioral pattern of the threat. We compare network architectures based on CNNs, LSTMs, and transformers, and explore the efficacy of unsupervised pre-training experimentally on large-scale telemetry data. We demonstrate how this system detects njRAT and other malware based on behavioral patterns.

READ FULL TEXT

page 8

page 13

11/19/2018

Behavioral Malware Classification using Convolutional Recurrent Neural Networks

Behavioral malware detection aims to improve on the performance of stati...
11/06/2019

The Naked Sun: Malicious Cooperation Between Benign-Looking Processes

Recent progress in machine learning has generated promising results in b...
01/29/2021

Peeler: Profiling Kernel-Level Events to Detect Ransomware

Ransomware is a growing threat that typically operates by either encrypt...
10/15/2019

Automated Ransomware Behavior Analysis: Pattern Extraction and Early Detection

Security operation centers (SOCs) typically use a variety of tools to co...
01/04/2019

Network-based Analysis and Classification of Malware using Behavioral Artifacts Ordering

Using runtime execution artifacts to identify malware and its associated...
11/25/2018

Poisoning Behavioral Malware Clustering

Clustering algorithms have become a popular tool in computer security to...
11/11/2022

SUNDEW: An Ensemble of Predictors for Case-Sensitive Detection of Malware

Malware programs are diverse, with varying objectives, functionalities, ...