Classification of malware families based on runtime behaviour
This paper distinguishes malware families from a specific category (i.e., ransomware) via dynamic analysis. We collect samples from four ransomware families and use Cuckoo sandbox environment, to observe their runtime behaviour. This study aims to provide new insight into malware family classificati...
| Main Authors: | , |
|---|---|
| Format: | Conference item |
| Published: |
Springer
2018
|
| _version_ | 1797075754948755456 |
|---|---|
| author | Geden, M Happa, J |
| author_facet | Geden, M Happa, J |
| author_sort | Geden, M |
| collection | OXFORD |
| description | This paper distinguishes malware families from a specific category (i.e., ransomware) via dynamic analysis. We collect samples from four ransomware families and use Cuckoo sandbox environment, to observe their runtime behaviour. This study aims to provide new insight into malware family classification by comparing possible runtime features, and application of different extraction and selection techniques on them. As we try many extraction models on call traces such as bag-of-words, ngram sequences and wildcard patterns, we also look for other behavioural features such as files, registry and mutex artefacts. While wildcard patterns on call traces are designed to overcome advanced evasion strategies such as the insertion of junk API calls (causing ngram searches to fail), for the models generating too many features, we adapt new feature selection techniques with a classwise fashion to avoid unfair representation of families in the feature set which leads to poor detection performance. To our knowledge, no research paper has applied a classwise approach to the multi-class malware family identification. With a 96.05% correct classification ratio for four families, this study outperforms most studies applying similar techniques. |
| first_indexed | 2024-03-06T23:54:41Z |
| format | Conference item |
| id | oxford-uuid:73cd7ab6-ce60-4ca4-a30b-7ebb931b6e1f |
| institution | University of Oxford |
| last_indexed | 2024-03-06T23:54:41Z |
| publishDate | 2018 |
| publisher | Springer |
| record_format | dspace |
| spelling | oxford-uuid:73cd7ab6-ce60-4ca4-a30b-7ebb931b6e1f2022-03-26T19:58:44ZClassification of malware families based on runtime behaviourConference itemhttp://purl.org/coar/resource_type/c_5794uuid:73cd7ab6-ce60-4ca4-a30b-7ebb931b6e1fSymplectic Elements at OxfordSpringer2018Geden, MHappa, JThis paper distinguishes malware families from a specific category (i.e., ransomware) via dynamic analysis. We collect samples from four ransomware families and use Cuckoo sandbox environment, to observe their runtime behaviour. This study aims to provide new insight into malware family classification by comparing possible runtime features, and application of different extraction and selection techniques on them. As we try many extraction models on call traces such as bag-of-words, ngram sequences and wildcard patterns, we also look for other behavioural features such as files, registry and mutex artefacts. While wildcard patterns on call traces are designed to overcome advanced evasion strategies such as the insertion of junk API calls (causing ngram searches to fail), for the models generating too many features, we adapt new feature selection techniques with a classwise fashion to avoid unfair representation of families in the feature set which leads to poor detection performance. To our knowledge, no research paper has applied a classwise approach to the multi-class malware family identification. With a 96.05% correct classification ratio for four families, this study outperforms most studies applying similar techniques. |
| spellingShingle | Geden, M Happa, J Classification of malware families based on runtime behaviour |
| title | Classification of malware families based on runtime behaviour |
| title_full | Classification of malware families based on runtime behaviour |
| title_fullStr | Classification of malware families based on runtime behaviour |
| title_full_unstemmed | Classification of malware families based on runtime behaviour |
| title_short | Classification of malware families based on runtime behaviour |
| title_sort | classification of malware families based on runtime behaviour |
| work_keys_str_mv | AT gedenm classificationofmalwarefamiliesbasedonruntimebehaviour AT happaj classificationofmalwarefamiliesbasedonruntimebehaviour |