Accurate and Robust Malware Analysis through Similarity of External Calls Dependency Graphs (ECDG) - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2021

Accurate and Robust Malware Analysis through Similarity of External Calls Dependency Graphs (ECDG)

Abstract

Malware is a primary concern in cybersecurity, being one of the attacker's favorite cyberweapons. Over time, malware evolves not only in complexity but also in diversity and quantity. Malware analysis automation is thus crucial. In this paper we present ECDGs, a shorter call graph representation, and a new similarity function that is accurate and robust. Toward this goal, we revisit some principles of malware analysis research to define basic primitives and an evaluation paradigm addressed for the setup of more reliable experiments. Our benchmark shows that our similarity function is very efficient in practice, achieving speedup rates of 3.30x and 354, 11x wrt. radiff2 for the standard and the cache-enhanced implementations, respectively. Our evaluations generate clusters that produce almost unerring results-homogeneity score of 0.983 for the accuracy phase-and marginal information loss for a highly polluted dataset-NMI score of 0.974 between initial and final clusters of the robustness phase. Overall, ECDGs and our similarity function enable autonomous frameworks for malware search and clustering that can assist human-based analysis or improve classification models for malware analysis.
Fichier principal
Vignette du fichier
iwcc.pdf (1.13 Mo) Télécharger le fichier
IWCC 2021 BPA - Puodzius et al..pdf (349.91 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-03328395 , version 1 (30-08-2021)

Identifiers

Cite

Cassius Puodzius, Olivier Zendra, Annelie Heuser, Lamine Noureddine. Accurate and Robust Malware Analysis through Similarity of External Calls Dependency Graphs (ECDG). ARES 2021 - The 16th International Conference on Availability, Reliability and Security, Aug 2021, Virtual, Austria. pp.1-12, ⟨10.1145/3465481.3470115⟩. ⟨hal-03328395⟩
115 View
395 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More