악성코드 패밀리 분류를 위한 API 특징 기반 앙상블 모델 학습
API Feature Based Ensemble Model for Malware Family Classification
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
본 논문에서는 악성코드 패밀리 분류를 위한 훈련 데이터의 특징을 제안하고, 앙상블 모델을 이용한 다중 분류 성능을 분석한다. 악성코드 실행 파일로부터 API와 DLL 데이터를 추출하여 훈련 데이터를 구성하며, 의사 결정 트리기반 Random Forest와 XGBoost 알고리즘으로 모델을 학습한다. 악성코드에서 빈번히 사용되는 API와 DLL 정보를 분석하며, 고차원의 훈련 데이터 특징을 저차원의 특징 표현으로 변환시켜, 악성코드 탐지와 패밀리 분류를 위한API, API-DLL, DLL-CM 특징을 제안한다. 제안된 특징 선택 방법은 데이터 차원 축소와 빠른 학습의 장점을 제공한다. 성능 비교에서 악성코드 탐지율은 Random Forest가 93.0%, 악성코드 패밀리 분류 정확도는 XGBoost가92.0%, 그리고 정상코드를 포함하는 테스트 오탐률은 Random Forest와 XGBoost가 3.5%이다.
Abstract
This paper proposes the training features for malware family analysis and analyzes the multi-classification performance ofensemble models. We construct training data by extracting API and DLL information from malware executables and useRandom Forest and XGBoost algorithms which are based on decision tree. API, API-DLL, and DLL-CM features formalware detection and family classification are proposed by analyzing frequently used API and DLL information frommalware and converting high-dimensional features to low-dimensional features. The proposed feature selection methodprovides the advantages of data dimension reduction and fast learning. In performance comparison, the malware detectionrate is 93.0% for Random Forest, the accuracy of malware family dataset is 92.0% for XGBoost, and the false positive rateof malware family dataset including benign is about 3.5% for Random Forest and XGBoost.
참고문헌 (20)
- Symantec internet security threat report, "Symantec", Symantec, ~, pp.ISTR-23-2018 (2018)
- P. Vinod, "Survey on malware detection methods", Proceedings of the 3rd Hacker's workshop on computer and internet security, pp.74~79 (2009)
- A survey of malware detection techniques, "N. Idika", Purdue University, ~ (2007)
- A. Patcha, "An overview of anomaly detection techniques : Existing solutions and latest technological trends", Computer networks, 51(12), pp.3448~3470 (2007)
- K. Rieck, "Learning and classification of malware behavior", Proceeding of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pp.108~125 (2008)
- B. Sun, "Malware family classification method based on static feature extraction", Proceeding of the 3rd IEEE International Conference on Computer and Communications(ICCC), pp.507~513 (2017)
- M. Ahmadi, "Novel feature extraction, selection and fusion for effective malware family classification", Proceedings of the 6th ACM conference on data and application security and privacy, pp.183~194 (2016)
- R. Veeramani, "Windows API based malware detection and framework analysis", Proceeding of the International conference on networks and cyber security, 25 (2012)
- M. Sikorski, "Practical Malware Analysis: the hands-on guide to dissecting malicious software" (2012), No Starch Press
- "avira antivirus for windows" (2019)[URL]
- C. Willems, "Toward Automated Dynamic Malware Analysis Using CWSandbox", IEEE Security and Privacy, 5(2), pp.32~39 (2007)
- G. Hunt, "Detours:Binary interception of Win32functions", Proceedings of the 3rd USENIX Windows NT Symposium, pp.135~143 (1999)
- "virus share" (2019)[URL]
- "kaspersky lab" (2019)[URL]
- L. Breiman, "Random forests", Machine learning, 45(1), pp.5~32 (2001)
- R. Ronen, "Microsoft Malware Classification Challenge", arXiv preprint arXiv:1802.10135, ~ (2018)
- T. Chen, "XGBoost:A scalable tree boosting system", Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp.785~794 (2016)
- C. Eagle, "The IDA pro book" (2011), No Starch Press
- "radare2" (2019)[URL]
- "Windows API Index, Windows API In dex" (2019)[URL]