Systems and methods for malware classification
The disclosed computer-implemented method for malware classification may include receiving dynamic analysis traces that include event descriptions regarding malware programs, and labels regarding classes of malware programs; performing a first mapping of the event descriptions to a first set of vector representations, wherein order of the events is not taken into account by the first mapping; performing a second mapping of the event descriptions to a second set of vector representations, wherein order of the events is taken into account by the second mapping; combining the first set of vector representations and the second set of vector representations into a combined set of vector representations; inputting the combined set of vector representations, along with the labels, into an autoencoder; and training the autoencoder to generate a feature space representation that correlates identified features with classes of malware. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for malware classification, the method being performed by one or more computing devices comprising at least one processor, the method comprising:
receiving, by the one or more computing devices, one or more dynamic analysis traces comprising event descriptions for a sequence of operations performed by a plurality of malware programs when executed in a controlled environment;
receiving, by the one or more computing devices, one or more labels regarding classes of malware programs;
performing, by the one or more computing devices, a first mapping of the event descriptions to a first set of N×M dimension vector representations that encode one or more patterns of an unordered combination of the operations, wherein:
N is a total number of operations in the one or more dynamic analysis traces; and
M is a number of different operations in the one or more dynamic analysis traces;
performing, by the one or more computing devices, a second mapping of the event descriptions to a second set of S dimension vector representations that encode S number of contiguous sequences of the N total number of operations in the one or more dynamic analysis traces;
concatenating the first set of vector representations and the second set of vector representations to form a third set of ((N×M)+S) dimension vectors representative of identified features of the plurality of malware programs;
inputting the third set of vector representations and the one or more labels into an autoencoder; and
training, by the one or more computing devices, the autoencoder by:
tuning one or more parameters of the autoencoder based on the one or more labels; and
generating a feature space representation for classifying malware that correlates the identified features of the plurality of malware programs with the classes of malware programs based on the third set of vector representations and the one or more parameters of the autoencoder.
2. The method of claim 1 , further comprising detecting, by the one or more computing devices, computer malware based on output of the trained autoencoder.
3. The method of claim 2 , further comprising, in response to detecting the computer malware, performing, by the one or more computing devices, a security action to protect the one or more computing devices from the detected computer malware.
4. The method of claim 3 , wherein the security action comprises one or more of: powering down, turning off, quarantining, sandboxing, inoculating, isolating, throttling, or inhibiting one or more computing resources.
5. The method of claim 1 , wherein the autoencoder comprises a variational autoencoder.
6. The method of claim 1 , wherein the first mapping comprises a bags-of-words analysis.
7. The method of claim 1 , wherein the first mapping comprises a skip-gram embedding.
8. The method of claim 1 , wherein the second mapping comprises one or more recurrent neural networks.
9. The method of claim 1 , wherein the second mapping comprises an N-gram analysis.
10. A system for malware classification, the system comprising:
at least one physical processor; and
physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
receive one or more dynamic analysis traces comprising event descriptions for a sequence of operations performed by a plurality of malware programs when executed in a controlled environment;
receive one or more labels regarding classes of malware programs;
perform a first mapping of the event descriptions to a first set of N×M dimension vector representations that encode one or more patterns of an unordered combination of the operations, wherein:
N is a total number of operations in the one or more dynamic analysis traces; and
M is a number of different operations in the one or more dynamic analysis traces;
perform a second mapping of the event descriptions to a second set of S dimension vector representations that encode S number of contiguous sequences of the N total number of operations in the one or more dynamic analysis traces;
concatenate the first set of vector representations and the second set of vector representations to form a third set of ((N×M)+S) dimension vectors representative of identified features of the plurality of malware programs;
input the third set of vector representations and the one or more labels into an autoencoder; and
train the autoencoder by:
tuning one or more parameters of the autoencoder based on the one or more labels; and
generating a feature space representation for classifying malware that correlates the identified features of the plurality of malware programs with the classes of malware programs based on the third set of vector representations and the one or more parameters of the autoencoder.
11. The system of claim 10 , wherein the computer-executable instructions, when executed by the physical processor, further cause the physical processor to detect computer malware based on output of the trained autoencoder.
12. The system of claim 11 , wherein the computer-executable instructions, when executed by the physical processor, further cause the physical processor to, in response to detecting the computer malware, perform a security action to protect the system from the detected computer malware.
13. The system of claim 12 , wherein the security action comprises one or more of: powering down, turning off, quarantining, sandboxing, inoculating, isolating, throttling, or inhibiting one or more computing resources.
14. The system of claim 10 , wherein the autoencoder comprises a variational autoencoder.
15. The system of claim 10 , wherein the first mapping comprises a skip-gram embedding.
16. The system of claim 10 , wherein the second mapping comprises one or more recurrent neural networks.
17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive one or more dynamic analysis traces comprising event descriptions for a sequence of operations performed by a plurality of malware programs when executed in a controlled environment;
receive one or more labels regarding classes of malware programs;
perform a first mapping of the event descriptions to a first set of N×M dimension vector representations that encode one or more patterns of an unordered combination of the operations, wherein:
N is a total number of operations in the one or more dynamic analysis traces; and
M is a number of different operations in the one or more dynamic analysis traces;
perform a second mapping of the event descriptions to a second set of S dimension vector representations that encode S number of contiguous sequences of the N total number of operations in the one or more dynamic analysis traces;
concatenate the first set of vector representations and the second set of vector representations to form a third set of ((N×M)+S) dimension vectors representative of identified features of the plurality of malware programs;
input the third set of vector representations and the one or more labels into an autoencoder; and
train the autoencoder by:
tuning one or more parameters of the autoencoder based on the one or more labels; and
generating a feature space representation for classifying malware that correlates the identified features of the plurality of malware programs with the classes of malware programs based on the third set of vector representations and the one or more parameters of the autoencoder.
18. The non-transitory computer-readable medium of claim 17 , wherein the one or more computer-executable instructions, when executed by at least one processor of the computing device, further cause the computing device to detect computer malware based on output of the trained autoencoder.
19. The non-transitory computer-readable medium of claim 18 , wherein the one or more computer-executable instructions, when executed by at least one processor of the computing device, further cause the computing device, in response to detecting the computer malware, perform a security action to protect the computing device from the detected computer malware.
20. The non-transitory computer-readable medium of claim 19 , wherein the security action comprises one or more of: powering down, turning off, quarantining, sandboxing, inoculating, isolating, throttling, or inhibiting one or more computing resources.