An AI Approach to Malware Similarity Analysis:
Mapping the Malware Genome With a Deep
Neural Network
Konstantin Berlin, Ph.D.
Lead Research Scientist
Invincea Labs
1

Why AI?

Number of Network Breaches Per Year
(Verizon’s 2016 Data Breach Investigations Report)• Intelligence is critical for
prevention and remediation• AI is good at finding
patterns in large data2

Intelligence through Similarity• Benefits• Identify threat actors• Link various attacks to a single actor• Quickly understand functionality• Speed up reverse engineering• Mitigation
Enterprise Network• Signatures• Network Rules3

Finding Similar Malware
Attribute Map (Embedding)

Attribute Extraction
Attribute B$$$
Similarity Search• MinHash• Feature hashing• Other sketching
• …

?
ABC

D

Attributes• Byte n-grams• Opcode n-grams• Printable strings• System calls• …

E
Attribute A
Jang, Jiyong et. al. Proceedings of the 18th ACM conference on Computer and communications security. ACM, 2011.
Sæbjørnsen, Andreas, et al. Proceedings of 18th international symposium on Software testing and analysis. ACM, 2009.
Bayer, Ulrich, et al. NDSS. Vol. 9. 2009.
4…Many moreIssues with Attribute Maps?

Attribute A

Possible Map #2?

Attribute B

Attribute B

Possible Map #1

Attribute A

How to get consistent results, regardless of attributes?

5Joshua Saxe and Konstantin Berlin, (MALWARE). IEEE, 2015.

Layer N

Not enough for a triage system!
[0,1]
Malware Detection
backdoor.msil.bladabindi.aa
backdoor.msil.bladabindi.aj…

Categorical ClassificationX

Layer X…

Layer 3Layer 2

Layer 1ABCDESupervised Classification (Endpoint Solution)

worm.winnt.lurka.a0.97 F1-score (precisionand recall)• 1500 MicrosoftFamilies
6• 2.0M Trainingfiles

Given a set of attributes how do
we create a “good” map?**No luck required7

Imaginary World of Malware Factories
Idealized Map• Each hidden factory produces
one malware family/variant• Factories are positioned relative
to what and how they exploit
vulnerabilities• …but this imaginary, no!?

Secret sauce B• Ideal World

Secret sauce A
8

There is No Spoon Map…
• We created the map when weselected the attributes• We can morph them in any way wechoose• One good way to morph theattributes is using a deep neuralnetwork
ABCDE

Deep NeuralNetworkabc“The Matrix”, 1999d9Morphing the MapABCDE

Variational Autoencoder

Kingma, D. P., & Welling, M. (2013). arXiv preprint arXiv:1312.6114.

Encoder

Deep Neural Network(Morphing)
Only one factory
Noiseabcd

Embedding

Family Labels

Clusters malware families

Decoderworm.win32.vobfus.hc…
trojanspy.win32.nivdort.af

Predicted Families

Secret sauce10Toy Embedding Visualization• ExampleABCDaEb• 8 family/variant prediction• 2D embedding
Only one factorybCollapse into a singularity

aClusters malware familiesbb

aInter-class distances not preserveda11

Results• Time-split Validation

Attribute Vector• 1500 family/variants(99% coverage)

F1-score 0.44

Semantic Embedding• 800K samples

Printable Strings

F1-score 0.66

Deep-learning Features
F1-score 0.94
small gap

no gap• Train on old data
• Test on 30 days later• Measure F1-score of
3-nearest neighborclassifier

Joshua Saxe and Konstantin Berlin, (MALWARE). IEEE, 2015.

gap

F1-score 0.96
large gap

12

Issues with Attribute Maps
Possible Embedding #2

Possible Embedding #1

Attribute B?
Secret sauce B

Attribute B?

Attribute A

Attribute A
Secret sauce A13

Conclusion• Developing feature extraction is expensive and requires time
consuming tuning to adapt to a specific domain• Traditional approaches to malware similarity are hard to tune
• Using supervised-learning approaches we can improve existing
features by embedding them into better maps
• Automatic (re)tuning will improve attribution and reduce cost14

More Information• Acknowledgement• Josh Saxe and Robert Gove
• Invincea Inc.

• More information• Name: Konstantin Berlin• Email: kberlin@invincea.com• Twitter: @kberlin• We are hiring!

• Research Scientist• Senior Research Scientist• Principal Research Scientists
15