악성코드 분석에서의 AI 결과해석에 대한 평가방안 연구
A Study on Evaluation Methods for Interpreting AI Results in Malware Analysis
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
정보보안에서 AI 기술은 알려지지 않은 악성코드를 탐지하기 위해 사용한다. AI 기술은 높은 정확도를 보장하지만, 오탐을 필연적으로 수반하므로 AI가 예측한 결과를 해석하기 위해 XAI 도입을 고려하고 있다. 그러나, XAI는 단순한 해석결과만 제공할 뿐 그 해석을 평가하거나 검증하는 XAI 평가 연구는 부족하다. XAI 평가는 어떤 기술이 더 정확한지 안전성 확보를 위해 필수적이다. 본 논문에서는 악성코드 분야에서 AI 예측에 크게 기여한 feature로 AI 결과를 해석하고, 이러한 AI 결과해석에 대한 평가방안을 제시한다. 약 94%의 정확도를 보이는 tree 기반의 AI 모델에 두 가지 XAI 기술을 사용하여 결과해석을 진행하고, 기술 정확도 및 희소성을 분석하여 AI 결과해석을 평가한다. 실험 결과 AI 결과해석이 적절하게 산출되었음을 확인하였다. 향후, XAI 평가로 인해 XAI 도입 및 활용은 점차 증가하고, AI 신뢰성 및 투명성이 크게 향상될 것으로 예상한다.
Abstract
In information security, AI technology is used to detect unknown malware. Although AI technology guarantees high accuracy, it inevitably entails false positives, so we are considering introducing XAI to interpret the results predicted by AI. However, XAI evaluation studies that evaluate or verify the interpretation only provide simple interpretation results are lacking. XAI evaluation is essential to ensure safety which technique is more accurate. In this paper, we interpret AI results as features that have significantly contributed to AI prediction in the field of malware, and present an evaluation method for the interpretation of AI results. Interpretation of results is performed using two XAI techniques on a tree-based AI model with an accuracy of about 94%, and interpretation of AI results is evaluated by analyzing descriptive accuracy and sparsity. As a result of the experiment, it was confirmed that the AI result interpretation was properly calculated. In the future, it is expected that the adoption and utilization of XAI will gradually increase due to XAI evaluation, and the reliability and transparency of AI will be greatly improved.
참고문헌 (19)
- D. Gavriluţ, "Malware detection using machine learning", 2009 International Multiconference on Computer Science and Information Technology, pp.735~741 (2009), IEEE
- Machine learning based malware analysis algorithm suitability study, "Gi-seung Baek", KISA, ~, pp.KISA-WP-2017-0014 (2017)
- K. Grosse, "Adversarial examples for malware detection", European Symposium on Research in Computer Security, pp.62~79 (2017)
- W. Huang, "A multi-task neural network for dynamic malware classification", Proc. of the Conference on Detection of Intrusions and Malware & Vulnerability Assessment, pp.399~418 (2016)
- N. McLaughlin, "Deep android malware detection", Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp.301~308 (2017)
- Z. L. Chua, "Neural nets can learn function type signatures from binaries", Proceedings of the 26th USENIX Security Symposium, pp.99~116 (2017)
- E. C. R. Shin, "Recognizing functions in binaries with neural networks", Proceedings of the 24th USENIX Security Symposium, pp.611~626 (2015)
- X. Xu, "Neural network-based graph embedding for cross-platform binary code similarity detection", ACM Conference on Computer and Communications Security, pp.363~376 (2017)
- Z. Li, "Vuldeepecker: a deep learning-based system for vulnerability detection", Network and Distributed System Security Symposium (NDSS) (2018)
- M.G. Schultz, "Data mining methods for detection of new malicious executables", Proceedings 2001 IEEE Symposium on Security and Privacy, pp.38~49 (2001)
- C.D. Manning, "An introduction to information retrieval" (2009), Cambridge University Press
- Sun-oh Choi, "Research trends in malware detection using deep learning", Journal of The KIISC, 27(3), pp.20~26 (2017)
- Y. Lin, "Towards interpreting ml-based automated malware detection models:a survey", arXiv Computer Science Cryptography and Security arXiv:2101.06232, ~ (2021)
- S. Gupta, "Malware characterization using windows api call sequences", International Conference on Security, Journal of Cyber Security and Mobility, 7, pp.363~378 (2018)
- S. Lundberg, "A unified approach to interpreting model predictions", Proceedings of the 31st International Conference on Neural Information Processing Systems, pp.4765~4774 (2017)
- L. S. Shapley, "A value for n-person games" (1953), Princeton University Press
- Hong-bi Kim, "Cost-effective valuable data detection based on the reliability of artificial intelligence", IEEE Access, 9, pp.108959~108974 (2021)
- M.T. Ribeiro, "’Why should i trust you?‘:explaining the predictions of any classifier", Proceedings of the 2016Conference of the North American Chapter of the Association for Computational Linguistics:Demonstrations, pp.97~101 (2016)
- A. Warnecke, "Evaluating explanation methods for deep learning in security", 2020 IEEE European Symposium on Security and Privacy (EuroS&P), pp.158~174 (2020)