MACHINE LEARNING — MALWARE CLASSIFICATION FRAMEWORK
By: Dr. Gulshan Kumar
Tags: Malware Analysis, Worms, Malware, Virus, Machine Learning

Malware types

Nowadays, malware is a significant concern for computer security experts. The variety and increasing number of malware affect millions of systems in the form of viruses, worms, Trojans etc. Many techniques have been proposed to analyze the malware to its class accurately. Some of analysis techniques analyzed malware based upon its structure, code flow, etc. without executing it (called static analysis), whereas other methods (termed as dynamic analysis) focused on monitoring the behaviour of malware by running it and comparing it with known malware behaviour. Dynamic analysis has proved to be useful in malware detection as behaviour is more challenging to mask while executing than its underlying code (static analysis).

We discuss framework for Malware classification using machine learning techniques. General framework for malware classification system using machine learning techniques shown in the following figure.

General malware classification framework

Executing malware in a controlled environment: Malware PE is run in a controlled environment for observing its behaviour. For example, Cuckoo sandbox can be used to run the malware and record its action in the form JSON reports. These reports contain the detailed recording of duration, system calls, its arguments, network information etc. The output of the module is set of reports in JSON format for malware and benign. Extracting features from execution reports: Raw elements are derived from the reports of Cuckoo environment. The extracted features are transformed into a tabular form and saved to a CSV ﬁle containing all possible dynamic characteristics of malware. The dynamically extracted features may include elements related to Dynamic Imports, File Operations, Mutex Operations, Network Operations, Processes Created, injected or terminated, Registry Operations, Windows API Calls and their frequency. Selecting relevant features: The module is optional (but recommended) and is responsible for choosing the most promising features from the raw feature dataset provided by the extraction module of the proposed framework. The malware dataset may contain some irrelevant and redundant features. Processing of these irrelevant and unnecessary features may lead to many problems including, 1) Undesirable delay in classiﬁcation task which in turn loses the real-time capability of MCS; 2) Increase computation overhead in terms of memory and time, and 3) Deteriorate the classiﬁcation and prediction accuracy of machine learning techniques. To address these issues, most researchers select relevant features using various feature selection techniques. Classifying malware: this phase classifies malware into different categories. The working of this module involves two phases, namely, training phase and testing phase.

a) Training Phase: A machine learning technique like MLP-ANN is being trained using identified features only for learning the behaviour of malware. The output of this phase is a trained model of the classiﬁer.

b) Testing Phase: Here, the trained model is given input of Test dataset in terms of selected features only to predict the class label of malware. A report is generated as an output that can be used by security analysts for further policy decisions.

5. Analyzing the performance of the system in terms of famous metrics like TPR, FPR, Accuracy etc.