Malware Analysis with Symbolic Execution and Graph Kernel
(2022) NordSec′22: The 27th Nordic Conference on Secure IT Systems — Location: Reykjavik
Files
Nordsec__Malware_Analysis_with_Symbolic_Execution_and_Graph_Kernel-3.pdf
Open Access - Adobe PDF
- 599.39 KB
Details
- Authors
- Abstract
- Malware analysis techniques are divided into static and dy- namic analysis. Both techniques can be bypassed by circumvention tech- niques such as obfuscation. In a series of works, the authors have pro- moted the use of symbolic executions combined with machine learning to avoid such traps. Most of those works rely on natural graph-based repre- sentations that can then be plugged into graph-based learning algorithms such as Gspan. There are two main problems with this approach. The first one is in the cost of computing the graph. Indeed, working with graphs requires one to compute and representing the entire state-space of the file under analysis. As such computation is too cumbersome, the techniques often rely on developing strategies to compute a representa- tive subgraph of the behaviors. Unfortunately, efficient graph-building strategies remain weakly explored. The second problem is in the clas- sification itself. Graph-based machine learning algorithms rely on com- paring the biggest common structures. This sidelines small but specific parts of the malware signature. In addition, it does not allow us to work with efficient algorithms such as support vector machine. We propose a new efficient open source toolchain for machine learning-based classifi- cation. We also explore how graph-kernel techniques can be used in the process. We focus on the 1-dimensional Weisfeiler-Lehman kernel, which can capture local similarities between graphs. Our experimental results show that our approach (1) outperforms existing ones by an impressive factor, (2) is resistant to static adversarial attacks.
- Affiliations
Citations
Bertrand Van Ouytsel, C.-H., & Legay, A. (2022). Malware Analysis with Symbolic Execution and Graph Kernel. NordSec′22: Proceedings of the 27th Nordic conference on Secure IT Systems, p. 292-310. https://hdl.handle.net/2078.5/219336