XAI기반 악성코드 그룹분류 결과 해석 연구
Analysis of Malware Group Classification with eXplainable Artificial Intelligence
0
조회
0
다운로드
6
인용
0
참고문헌
키워드
초록
컴퓨터의 보급 증가와 더불어 일반 사용자들에 대한 공격자들의 악성코드 배포 횟수 또한 증가하였다. 악성코드를 탐지하기 위한 연구는 현재까지도 진행되고 있으며 최근에는 AI를 이용한 악성코드 탐지 및 분석 연구가 중점적으로 이뤄지고 있다. 하지만 AI 알고리즘은 어떠한 이유로 악성코드를 탐지하고 분류하는지 설명할 수 없다는 단점이 존재한다. 이런 AI의 한계를 극복하고 실용성을 갖도록 하기 위해 XAI 기법이 등장하였다. XAI를 사용하면 AI의 최종 결과에 대해 판단 근거를 제시할 수 있다. 본 논문에서는 XGBoost와 Random Forest를 이용하여 악성코드 그룹분류를 진행하였으며, SHAP을 통해 결과를 해석하였다. 두 분류모델 모두 약 99%의 높은 분류 정확도를 보였으며, XAI를 통해 도출된 상위 API feature와 악성코드 주요 API를 비교해보았을 때 일정 수준 이상의 해석 및 이해가 가능하였다. 향후, 이를 바탕으로 직접적인 AI 신뢰성 향상 연구를 진행할 예정이다.
Abstract
Along with the increase prevalence of computers, the number of malware distributions by attackers to ordinary users has also increased. Research to detect malware continues to this day, and in recent years, research on malware detection and analysis using AI is focused. However, the AI algorithm has a disadvantage that it cannot explain why it detects and classifies malware. XAI techniques have emerged to overcome these limitations of AI and make it practical. With XAI, it is possible to provide a basis for judgment on the final outcome of the AI. In this paper, we conducted malware group classification using XGBoost and Random Forest, and interpreted the results through SHAP. Both classification models showed a high classification accuracy of about 99%, and when comparing the top 20 API features derived through XAI with the main APIs of malware, it was possible to interpret and understand more than a certain level. In the future, based on this, a direct AI reliability improvement study will be conducted.
참고문헌 (21)
- Dragoş Gavriluţ, "Malware detection using machine learning", 2009 International Multiconference on Computer Science and Information Technology, pp.735~741 (2009), IEEE
- Gi-seung Baek, "Machine learning based malware analysis algorithm suitability study", KISA-WP-2017-0014, KISA, ~ (2017)
- Alejandro Barredo Arrieta, "Explainable Artificial Intelligence (XAI):Concepts, taxonomies, opportunities and challenges toward responsible AI", Information Fusion, 58, pp.82~115 (2020)
- Aslan, Ömer Aslan, "A comprehensive review on malware detection approaches", IEEE, 8, pp.6249~6271 (2020)
- Si-haeng Cho, "Trends in response technology and standardization according to the evolution of malicious code", TTA Journal, 118 (2008)
- M. Shankarapani, "Kernel machines for malware classification and similarity analysis", The 2010 international joint conference on neural networks(IJCNN), pp.1~6 (2010), IEEE
- Hellal, Aya, "Minimal contrast frequent pattern mining for malware detection", Computers & Security, 62, pp.19~32 (2016)
- Han Weijie, "MalDAE: Detecting and explaining malware based on correlation and fusion of static and dynamic characteristics", Computers & Security, 83, pp.208~233 (2019)
- Sami, A., "Malware detection based on mining API calls", Proceedings of the 2010 ACM symposium on applied computing, pp.1020~1025 (2010)
- Chen, Tianqi, "XGBoost: A scalable tree boosting system", Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, pp.785~794 (2016)
- Qi, Yanjun, "Ensemble machine learning", pp.307~323 (2012), Springer
- Azmee, ABM.Adnan, "Performance analysis of machine learning classifiers for detecting PE malware", PhD, pp.2019
- Oshiro, T. M., "How many trees in a random forest?", MLDM 2012:Machine Learning and Data Mining in Pattern Recognition, 737, pp.154~168 (2012)
- Amir Bahador Parsa, "Toward safer highways, application of XGBoost and SHAP for real-time accident detection and feature analysis", Accident Analysis &Prevention, 136 (2020)
- Gupta, S., "Malware characterization using windows API call sequences", International Conference on Security, Privacy, and Applied Cryptography Engineering, pp.271~280 (2016), Springer
- Maonan Wang, "An explainable machine learning framework for intrusion detection systems", IEEE, 8, pp.73127~73141 (2020)
- Alvin E. Roth, "A value for n-person games" (2016), Princeton University Press
- Lundberg, Scott, "A unified approach to interpreting model predictions", arXiv preprint arXiv:1705.07874, ~ (2017)
- Štrumbelj, Erik, "Explaining prediction models and individual predictions with feature contributions", Knowledge and information systems, 41(3), pp.647~665 (2014)
- Staniak, Mateusz, "Explanations of model predictions with live and breakDown packages", arXiv preprint arXiv:1804.01955, ~ (2018)
- "VirusTotal"[URL]