Method and system for zero-day malware similarity detection

Abstract

The invention relates to a method and system for zero-day malware similarity detection. A method at a computing device includes segmenting a malware sample into a plurality of byte strings, each byte string of the plurality of byte strings having a predetermined length; embedding each byte string of the plurality of byte strings into an embedded network to generate a plurality of inlays; finding a nearest neighbor for each of the plurality of inserts; and setting a predictive family for the malware sample based on a fusion of the nearest neighbors for each of the plurality of inlays.

Description

Technical Field

[0001] The present disclosure relates to malware similarity detection, and in particular to unknown (zero-day) family detection. Background Art

[0002] With the rapid development of artificial intelligence (AI) and deep learning (DL) in recent years, learned systems are being applied to help humans in all aspects of life. Applications using AI in areas that require large amounts of data processing have seen greater success. One such application is cybersecurity.

[0003] One area of ​​cybersecurity is malware analysis. Malware is malicious code that may be intended to cause damage to a computer system, for example by disrupting functionality on the computer or the computer's operating system, or by stealing sensitive data from the computer system. Malware analysis is the process of determining the functionality, origin, and / or potential impact of a malware sample.

[0004] In the cybersecurity task of malware analysis, governments and companies must search for malware among the millions of files that enter their networks every year. According to the AVTEST agency, 70,687,826 new unique malware samples were cataloged for Windows systems alone in 2022. Human investigation is impossible at this scale, and traditional signature-based methods can be circumvented through packing and other obfuscation techniques.

[0005] The task of malware analysis is not simply to discover whether a file has malicious intent. Challenges within the malware analysis space are family detection, similarity analysis, and zero-day family detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The present disclosure will be better understood with reference to the accompanying drawings, in which:

[0007] Figure 1 It shows the classification of malware samples To the tribe and classify unknown samples into new families.

[0008] Figure 2 is a block diagram illustrating traditional family-level similarity analysis.

[0009] Figure 3 is a block diagram showing segmentation of samples and aggregation of results for similarity analysis.

[0010] Figure 4 is a block diagram illustrating training an embedding network from a corpus of malware and harmless software.

[0011] Figure 5 is a block diagram of the gym environment showing further training of the embedding network.

[0012] Figure 6 is a block diagram of a matching environment for matching unknown malware byte strings to families and / or classifying byte strings as zero-day samples.

[0013] Figure 7 is a block diagram illustrating the use of different data sets in training and testing of an embodiment of the present disclosure.

[0014] Figure 8 is a graph of a receiver operating characteristic (ROC) curve for in-sample classification comparing the present embodiment with an ablation study.

[0015] Fig. 9 is a graph of a ROC curve plot for out-of-sample classification comparing the present embodiment with an ablation study.

[0016] Fig.10 is a graph of ROC curves for zero-day binary classification comparing the present embodiment with an ablation study.

[0017] Fig.11 is a graph of ROC curves for zero-day family classification comparing the present embodiment with an ablation study.

[0018] Fig.12 is a block diagram of a simplified computing device that can be used with embodiments of the present disclosure. DETAILED DESCRIPTION

[0019] The present disclosure provides a method at a computing device, comprising: segmenting a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embedding each of the plurality of byte strings into an embedding network to generate a plurality of embeddings; finding a nearest neighbor for each of the plurality of embeddings; and setting a prediction family for the malware sample based on a fusion of the nearest neighbors for each of the plurality of embeddings.

[0020] The present disclosure also provides a computing device, including: a processor; and a memory, wherein the computing device is configured to: segment a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embed each of the plurality of byte strings into an embedding network to generate a plurality of embeddings; find a nearest neighbor for each of the plurality of embeddings; and set a prediction family for the malware sample based on a fusion of the nearest neighbors for each of the plurality of embeddings.

[0021] The present disclosure also provides a computer-readable medium for storing instruction codes, which, when executed by a processor of a computing device, causes the computing device to: segment a malware sample into a plurality of byte strings, each of the plurality of byte strings having a predetermined length; embed each of the plurality of byte strings into an embedding network to generate a plurality of embeddings; find a nearest neighbor for each of the plurality of embeddings; and set a prediction family for the malware sample based on a fusion of the nearest neighbors for each of the plurality of embeddings.

[0022] Due to the constantly evolving landscape of attack methods, and the large volume of new malware every day, it is impossible for humans to independently detect and categorize malware.

[0023] With recent advances in artificial intelligence and machine learning (ML), learning algorithms have been proposed to solve problems in cyber threat intelligence. Features used in ML for malware detection can be separated into the categories of static analysis and dynamic analysis.

[0024] Dynamic analysis involves running a software sample in a sandbox environment and examining the behavior, while static analysis aims to determine whether a sample is malicious or harmless based on analyzing the code or structure.

[0025] A common feature for static malware detection is the raw byte sequence. Raw byte sequences have been used for the task of malware detection together with convolutional neural networks. To expand from malware detection, static analysis has also shown success in malware similarity analysis using deep learning models. A common deep learning method that has recently achieved success is the Siamese Neural Network.

[0026] The twin neural network architecture is a learning method for similarity analysis. The twin network is learned by a twin learning algorithm or a triple learning algorithm. The twin network was first proposed in the work of Bromley et al., "Signature verification using a "siamese" time delay neural network", in Advances in Neural Information Processing System, vol. 6., the content of which is incorporated herein by reference, in which a twin twin network was proposed for measuring the similarity between human signatures written on a pen-input board.

[0027] The work by Koch et al. on measuring the similarity between two images was applied to the broader problem of image similarity. "Siamese neural networks for one-shot image recognition", Department of computer science, University of Toronto, the contents of which are incorporated herein by reference. In the work by Koch et al., they showed that twin Siamese networks can be used to compare the similarity of images from classes that contain only a single sample in the training data (one-shot classification).

[0028] The work of Koch et al. has led to the application of twin networks in many domains, including malware similarity analysis. The twin network was extended to a triplet network with FaceNet, as proposed by F. Schroff et al., "FaceNet: A unified embedding for face recognition and clustering", Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 815-823, the entire contents of which are incorporated herein by reference. FaceNet is a convolutional neural network that is trained to generate embeddings for facial images that can be compared by L2 distance.

[0029] Similar to recent work using twin-based architectures for software similarity analysis, in embodiments of the present disclosure, static features extracted from the code base of malware samples are used. Instead of using image representations of malware executables or features extracted from reverse engineering techniques, embedded representations can be generated using raw byte sequences directly from malware binaries.

[0030] The twin network architecture has been used to classify malware into discrete sets of malware families. The network is equipped with a Softmax (normalized exponential) activation head. The Softmax activation head is used to classify two samples into discrete sets of malware families in the training data. Zhu et al., "A few-shot meta-learning based siamese neural network using entropy features for ransomware classification", Computers & Security, vol. 117, p. 102691, ("A few-shot meta-learning based siamese neural network using entropy features for ransomware classification", Computers & Security, vol. 117, p. 102691), the contents of which are incorporated herein by reference, propose a twin twin network with a Softmax activation head for ransomware detection and classification. The method has achieved success in few-shot classification of ransomware families.

[0031] YHChen et al., “Similarity-based malware classification using graph neural networks”, Appl.Sci. 2022 vol.12, no.21, p.10837, the contents of which are incorporated herein by reference, improve upon the work of the Softmax maximum activation network by designing a multi-headed network that classifies output families as well as embeddings for similarity analysis.

[0032] The work of SCHsiao et al., "Malware image classification using one-shot learning with Siamese networks", Procedia computer science, vol. 159, pp. 1863-1871; and M. Conti et al., "A few-shot malware classification approach for unknown family recognition using malware feature visualization", Computers & Security vol. 122, p. 102887, the contents of which are incorporated herein by reference, uses a twin architecture for malware similarity scores. Given an unknown sample and a support set, a similarity score is found for each support sample with the unknown sample. The unknown sample is classified into the same family as the support sample with the highest similarity. Hsiao et al. proposed a system for finding similarities between two malware samples. Using byte-to-pixel images of malware samples as input, Hsiao et al. showed that the deep framework proposed by Koch et al. (supra) can be applied to the problem of malware similarity scores. Conti et al. proposed a multi-network system based on three-channel images (grayscale matrix image + entropy map image + Markov image) to find similarity scores on two malware samples.

[0033] The work of C.Molloy et al., "Adversarial variational modality reconstruction and regularization for zero-day malware variants similarity detection", in 2022 IEEE International Conference on Data Mining (ICDM), pp. 1131-1136, the contents of which are incorporated herein by reference, explored methods for generating embeddings for storage and similarity analysis. In the work of Molloy et al., they proposed a generative adversarial network for malware embedding generation using reconstruction. Similar to the work of Conti et al., Molloy et al. used multiple static feature vectors from a single malware sample as input to their network. Instead of using different image modalities, Molloy et al. used five statically analyzed features extracted from each sample (bytecode + import text + string text + byte image + byte image signature).

[0034] Based on this, and with the increasing number of new malware variants and families every year, tools for efficient and accurate family matching and unknown (zero-day) family detection are needed. Current state-of-the-art deep learning schemes trained with twin loss or triplet loss do not show any evidence of scalability for real-world malware classification environments. Also, the solutions lack any mechanism for unknown family detection.

[0035] Therefore, according to an embodiment of the present disclosure, a multi-machine learning (ML) system for malware family classification and zero-day family detection is provided. Embodiments of the present disclosure include an embedding network trained in two different scenarios for byte string embedding and an open set approximate nearest neighbor algorithm for family matching and zero-day detection. The embedding network uses a triplet loss for embedding generation and reinforcement-based expectation maximization (EM) learning for generalization.

[0036] Furthermore, embodiments of the present disclosure provide approximate nearest neighbors with open set classification for scalable malware family detection on byte strings extracted from each sample.

[0037] Testing of embodiments of the present disclosure using multiple in-sample and out-of-sample experiments was performed to ensure that the model was not biased towards the malware families in training. Testing also found that embodiments of the present disclosure can detect samples outside of the known malware sample set with very high accuracy.

[0038] Malware family

[0039] As indicated above, challenges for malware analysis include family detection, similarity analysis, and zero-day family detection.

[0040] Specifically, for a large number of unique malware samples, they are classified into families. A malware family is a collection of malware that share different samples of malicious code, such as described in Turner et al., "Symantec internet security threat report: trends for July 2004-December 2004", Retrieved July, vol. 30, p. 2005, 2005, the contents of which are incorporated herein by reference.

[0041] In particular, as described in Turner (supra), the first sample in a family is an unseen and unique part of the malware. All other samples within the family are variants, iterations of the original sample with a few differences. Malware samples can only be classified into a single family after the variant is a modification of the original code with a few differences.

[0042] Conventional family detection methods aim to classify new samples into families based on the known knowledge space. For example, such conventional methods are described in D. Ucci et al., "Survey of machine learning techniques formalware analysis", Comput. Secur., vol. 81, pp. 123-147, 2019; J. Zhu et al., supra; Chen et al., supra; K Huang et al., "Ismcs: An intelligent instruction sequence based malware categorization system", in 2009 3rd International Conference on Anti-counterfeiting, Security, and Identification in Communication, 2009, pp. 509-512; YHPark et al., "Fast malware classification by automated behavioral graph matching", in Proceedings of the 6th Cyber ​​Securityand Information Intelligence Research Workshop, CSIIRW 2010, Oak Ridge, TN, USA, April 21-23, 2010; GEDahl et al., “Largescale malware classification using random projections and neural networks,” in IEEE International Conference on Acoustics, Speech and Signal Processing, ICASSP 2013, Vancouver, BC, Canada, May 26-31, 2013. IEEE, 2013, pp. 3422-3426; and Y.YE et al., “Automatic malware categorization using cluster ensemble,” in Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Washington, DC, USA, July 25-28, 2010 ("Automatic Malware Classification Using Cluster Ensembles", 2010 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Washington, DC, USA, July 25-28, 2010) the entire contents of which are incorporated herein by reference. .

[0043] An emerging area of ​​research is malware similarity analysis, in which methods are proposed for assessing similarities between samples of software that allow for more nuanced analysis. For example, such methods are described in C. Molloy et al., supra; SCHsiao et al., supra; and M. Conti et al., supra.

[0044] By providing a similarity score between each sample, Cyber ​​Threat Intelligence (CTI) experts can map the evolution of malware variants for attack campaign monitoring.

[0045] Another possible application of malware similarity analysis is zero-day family detection. Zero-day family detection is the challenge of finding new and different samples of malicious code to tag for human investigation. In the case of discrete set family classification, there is no mechanism for signaling if an incoming sample is outside the family set. In the case where samples from zero-day families have unknown signatures, structures, and intent, a comprehensive CTI system requires zero-day family detection for network protection.

[0046] Reference now Figure 1 Incoming malware usually consists of new variants of known families or samples associated with zero-day attack campaigns. Classification-based methods cannot handle samples for zero-day attacks or new malware families. Using a similarity analysis system, the incoming samples are analyzed and compared with samples from known families. If the sample is not within the predefined boundaries, it is likely to be a zero-day family.

[0047] Specifically, in Figure 1 In the embodiment of FIG. 1 , known families 110 are separated from samples from new attack 112. Known families 110 include families 120, families 122, and families 124. Samples from new attack 112 include new families 130.

[0048] As new malware samples are received, they can be classified into existing families. Figure 1 In the example of FIG. 1 , sample 140 , sample 142 , and sample 144 are classified within cluster 120 . Sample 146 and sample 148 are classified within cluster 122 . Sample 150 and sample 152 are classified within cluster 124 .

[0049] Sample 154 , sample 156 , and sample 158 are not within the predefined boundaries and are therefore classified within new family 130 .

[0050] Similarity Analysis

[0051] One DL approach for malware similarity analysis is to apply Siamese neural networks, which are learned using twin-tuple or triple-tuple meta-learning methods for direct classification, similarity scoring, or similarity embedding generation.

[0052] Methods have shown the ability to match similarities between malware samples on a malware family basis, such as described in Molloy et al., Hsiao et al., and Conti et al. (supra). However, only Molloy has generated a TM ) Malware Similarity Embedding. By leveraging a diverse set of malware descriptors for each sample, Molloy et al. designed an embedded network for malware sample storage and family detection.

[0053] Although Molloy et al. have shown success in matching samples by measuring the distance between embeddings, there are unsolved challenges in the field of malware similarity analysis. One such challenge is accurately matching malware samples that have been explicitly modified for evasion. Such challenges are outlined, for example, in C. Molloy et al., “H4rm0ny: A competitive zero-sum two-player markov game for multi-agent learning on evasive malware generation and detection,” in 2022 IEEE International Conference on Cyber ​​Security and Resilience (CSR), pp. 22-29 [molloy-2]; and O. Suciu et al., “Exploring adversarial examples in malware detection,” in 2019 IEEE Security and Privacy Workshops, SP Workshops 2019, San Francisco, CA, USA, May 2019. 19-23, 2019. IEEE, 2019, pp. 8-14 (“Exploring Adversarial Examples in Malware Detection,” in 2019 IEEE Symposium on Security and Privacy (SP Symposium 2019), San Francisco, CA, USA, May 19-23, 2019. IEEE, 2019, pp. 8-14) The contents of both are incorporated herein by reference.

[0054] In Molloy-2 (supra), it is shown that appending harmless bytes to the end of a malware sample provides a method for circumventing ML-based malware classifiers.

[0055] Therefore, reference Figure 2 , the malicious code 210 has a harmless (or noise) code 212 injected into it. This results in a low similarity score when analyzing the combination of the malicious code 210 and the harmless code 212 using conventional file-level similarity analysis. Figure 2In the example of , this is shown as a similarity score of 0.2. However, such a similarity score is provided only as an illustration, and those skilled in the art will understand that the similarity score of the file will vary based on the sample.

[0056] One possible solution to this approach is by segmenting the incoming samples and performing similarity analysis on each segment, and then aggregating the segmented results.

[0057] Reference now Figure 3 .exist Figure 3 In the example of FIG. 3 , malicious code 310 has harmless code 312 injected thereafter. Malicious code 310 and harmless code 312 may be associated with Figure 2 The malicious code 210 and the harmless code 212 are the same.

[0058] However, in Figure 3 In the embodiment of the present invention, the first step 320 involves segmenting the file into various code segments. Each of the code segments can then be analyzed for similarity scores to malware variants. Thus, as shown in FIG. Figure 3 As can be seen, in step 320, malicious code 310 is segmented and analyzed. Similarly, harmless code 312 is segmented and analyzed. As will be appreciated by those skilled in the art, for unseen malicious code samples, the delineation between malicious code 310 and harmless code 312 is generally not known in advance.

[0059] After analysis, the segments of malicious code 310 have high similarity scores, while the segments of injected harmless code 312 have low similarity scores.

[0060] Then the second step 330 can be used to aggregate the document level similarities. Figure 3 In the example of FIG. 3 , the file-level analysis by aggregation at step 330 produces a similarity score of 0.95, which is significantly higher than Figure 2 However, such similarity scores are provided only as an illustration, and those skilled in the art will appreciate that similarity scores for files will vary based on samples.

[0061] Matching at the segment level can help mitigate the problem of byte injection, since the decision making process does not have to consider all segments equally. However, creating a solution that performs segment-level matching is difficult. In contrast to current solutions, the input dimensionality to the Siamese network is much smaller in segment-based solutions. In practice, the network was found to perform well in triplet training tasks, but when transferred to a deployed environment, where incoming segments are compared to known segments for similarity analysis, performance drops significantly.

[0062] To address this neighbor search challenge, training can be provided for neighbor search. Such training can simulate a deployment environment where, for example, Figure 3 In step 320, the segments are matched to their closest neighbors for similarity analysis.

[0063] This method uses a set of fragments pre-embedded by the network for training samples to search through (support set). However, this training cannot directly optimize the model because the support set used will contain the error of the model, making it only an optimal approximation. Therefore, an iterative training method that updates both the network and the support set is provided in this paper for network optimization.

[0064] The solution to this method is expectation maximization (EM). EM is an iterative method for finding optimal parameters of statistical models that cannot be solved directly. By interpreting the search results on the training samples as a probability distribution of a family, the rewards can be derived and trained through the network using the reinforcement learning (RL) paradigm. The support set can then be regenerated using the updated distribution parameter estimates.

[0065] According to an embodiment of the present disclosure, a malware embedding and open set family detection system utilizing multiple machine learning modules is provided. In some environments, such a family detection system can be divided into three subcomponents.

[0066] The first subcomponent is an embedded network of embedded software bytecode strings. For example, in some embodiments, the bytecode can be one kilobyte (1024 bytes) long. However, other lengths of the bytecode are possible, and the present disclosure only uses one kilobyte for illustrative purposes.

[0067] The embedding network aims to generate embeddings for strings of bytes that best represent functions of kilobytes, instead of embeddings that best represent families of samples.

[0068] In some embodiments, the embedding network is trained on triple pairs derived from malware and benign software to ensure discrimination of byte string functions.

[0069] The second subcomponent is the training gym environment. In particular, the training gym environment is used to address the challenge of fragment matching and includes a dynamic embedding nearest neighbor matching gym.

[0070] The training gym environment performs nearest neighbor search on the changing support set for network generalization. Since the direct loss is computed from the non-differentiable similarity search, the RL scheme is used together with EM for sequential search and update training.

[0071] Training the embedding network in a simulated malware classification environment after initial training improves the family matching accuracy and reduces the distance between samples within the same family.

[0072] A third subcomponent of a matching environment is included. The matching environment is built on an approximate nearest neighbor algorithm for open set family detection, such as described by YAMalkov et al. in “Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs”, IEEE transactions on pattern analysis and machine intelligence, vol. 42, no. 4, pp. 824-836, 2018, the contents of which are incorporated herein by reference.

[0073] Therefore, embodiments of the present disclosure provide a multi-ML system for malware family detection that leverages the meta-learning structure of Siamese neural networks.

[0074] Embodiments of the present disclosure also provide an RL method for further training the embedding network for dynamic support set nearest neighbor search.

[0075] Embodiments of the present disclosure also combine decision fusion of byte string family classification from open set nearest neighbor family matching for fast and accurate malware classification.

[0076] Embodiments of the present disclosure have been implemented in practice, where such embodiments have been trained on real-life malware samples, and the system has been evaluated on both in-sample and out-of-sample malware families in chronological order. Results from such actual implementations show that the model outperforms current state-of-the-art methods for malware variant similarity analysis in both known family detection and zero-day family detection.

[0077] The following describes the model in terms of both training the model and deploying the model. Training the model is divided into two phases. The first phase is referenced Figure 4 Described, Phase II reference Figure 5 Described. Deployment is described below. Figure 6 is described.

[0078] Reference now Figure 4 , which describes embedding network training. In particular, the embedding network is a deep convolutional network for byte string embedding. Given a string of bytes from a software executable, the embedding network generates an embedding that represents the byte string in Euclidean space.

[0079] In some cases, the byte string may include 1024 bytes. However, in other cases, fewer or more bytes may be included. Specifically, the input to the embedding network is a byte string of a certain length extracted from the malware. The length may be chosen to balance the number of functions that can be modeled by the byte string with the input size to the neural network. Likewise, batch mode computations performed within a central processing unit (CPU) and a graphics processing unit (GPU) may be considered.

[0080] A byte string is a vector of integer values ​​in the range [0, 255], where each value represents a byte of binary code. Byte strings are chosen as the input modality to the embedding network of the present disclosure due to the speed and accuracy of extraction. Many ML-based systems designed for malware analysis require each sample to be decompiled before analysis. However, decompilation is not a deterministic process, and many parameters within the decompilation software may greatly affect the resulting source code used to analyze the sample. Byte strings can be read directly from the executable file to remove any non-deterministic processes from the embedded system.

[0081] Therefore, in Figure 4 In an embodiment of the present invention, a corpus 410 of malware and harmless software is provided.

[0082] The triplet selection process 420 includes the selection of two malware variants from the same family, and the selection of a harmless sample from the corpus 410 , as shown at block 422 .

[0083] The selected malware variants and harmless samples are then segmented into byte strings of the selected length at block 424 .

[0084] Then, at block 426, the segments are arranged into triplet pairs, where the anchor sample and the positive sample of each triplet pair are from the same malware family, and the negative sample is selected from the harmless sample.

[0085] More specifically, in the triple selection process 420, files are selected from the corpus 410 of malware and harmless software in a manner with replacement. Three files are selected from the corpus for a single triple pair. Files for anchor samples and positive samples are selected from the same malware family without replacement. Negative samples are randomly selected from the harmless software set. Each file can be defined as a set of byte strings. Each set can be defined to contain all non-overlapping byte strings of a specific length contained in the selected file. The method removes the final byte string of each file that is less than the selected length to avoid any negative sample surface effects on similarity training caused by padding, which is necessary on the final byte string to extend it to the selected length in bytes. For anchor samples, positive samples, and negative samples, byte string vectors can be defined as a, p, and n, respectively.

[0086] For a triplet pair, index q is randomly selected as the starting index, subject to the following constraints:

[0087] q≡0mod length (1)

[0088] q<min(dim(a),dim(p),dim(n))-length (2)

[0089] In the above equations (1) and (2), length is the selected length. For example, if the selected length is 1024 bytes, length will be 1024.

[0090] The constraints in equations (1) and (2) omit the byte string at the end of each file. A triplet pair is a byte string of length selected from a, p, and n at index q.

[0091] The triple selection process 420 is then repeated to create a large number of triple pair data sets. This method is used to generate data for training and validating the embedding network. For a set of malware and harmless software, a large number of unique triple pairs can be sampled for training.

[0092] The maximum number of triples that can be generated from the malware set and the harmless software set can be defined as follows. First, the software cutting function can be defined as: where α is arbitrary and has the input of a software sample, and outputs the number of byte strings that can be generated from the sample. The cutting function c can be defined as:

[0093] c(l)=dim(l)-dim(l)mod length (3)

[0094] Where l is the software sample.

[0095] Given a malware set of size m in is the set of malware samples in family j, and the set of harmless software samples of k harmless software For any malware family with p samples Can target any malware sample j，r The number of triple pairs made can be calculated as follows:

[0096]

[0097] Equation (4) can be expanded on each file in the malware family and on each family in the malware set M. This software segmentation process allows the generation of very large datasets for model training.

[0098] As an example, given a malware family with two samples, each 1 megabyte (1048576 bytes) in length, and a harmless software set, each 1 megabyte in length, prior work in this area would be able to generate two triple pairs. However, software slicing allows for 2000 unique triple pairs according to the triple selection process of block 420. This wide range of possible training examples from a small software set allows for a more diverse training set given the same malware samples compared to prior art.

[0099] Reference again Figure 4 , these triplets can then be used for embedding network training. In particular, the embedding network 430 can be initialized with random weights.

[0100] An embedding network 430 is used in the malware family detection space, where the input to the embedding network 430 includes the byte string of the original executable. This is different from past work on malware similarity analysis through twin networks, which previously generated embeddings or similarity scores based on information from the entire sample. Therefore, given that previous work has aimed to train a network to find similarities between entire malware samples, one motivation for the present system and method is to reduce the impact of a few changes made to the malware by creating multiple embeddings for a single sample.

[0101] In some cases, the structure used for embedding network 430 can be based on the FaceNet architecture proposed in F. Schroff et al., supra.

[0102] The structure of FaceNet is a batch of two-dimensional convolutional layer blocks, pooling layer blocks, and normalization layer blocks. Since the input of the embedding network 430 is a one-dimensional byte string, the two-dimensional convolutional layer is replaced by a one-dimensional convolution in some embodiments.

[0103] In the domain of image embeddings, the FaceNet architecture has achieved great success. Similar networks have also achieved success in the domain of malware similarity analysis without using normalization layers throughout the network, as described, for example, in Hsiao (ibid.).

[0104] While the embedding network 430 works within the domain of malware analysis, it normalizes the data throughout the architecture due to the embedding properties being more similar to FaceNet than other networks in malware similarity analysis. While it is typical to use sequence-based network layers (such as long short-term memory layers or gated recurrent unit layers) on one-dimensional byte strings, one-dimensional convolutional layers have been successful in the domain of malware detection with the added benefit of reducing runtime, as described, for example, by E. Raff et al., "Malware detection by eating awhole EXE," arXiv:1710.09435v1, the contents of which are incorporated herein by reference.

[0105] The structure of the embedding network 430 can be seen below in Table 1. In the example of Table 1, the embedding network 430 architecture has fewer convolutional blocks than the previously discussed work; this is chosen because the input dimension of the embedding network 430 is significantly smaller than the other networks discussed above.

[0106] layer Input size Output size Kernel parameter Embed 1024 1024x8 2048 conv 1a 1024x8 897x64 128 65600 mpool 897x64 224x64 0 bnorm 224x64 224x64 256 conv 1b 224x64 193x32 32 65568 mpool 193x32 96x32 0 bnorm 96x32 96x32 16 128 conv 1c 96x32 81x32 16416 mpool 81x32 20x32 0 bnorm 20x32 20x32 128 Flatten 20x32 640 0 L2 640 0 total 150144

[0107] Table 1: Structure of the embedded network deep convolutional network

[0108] Then, as shown by arrow 432, the embedding network 430 is trained using triplet loss. In particular, the embedding of the byte string x can be represented as Where f(·) is the embedding network 430, and d is the output dimension of the embedding network 430. As described in Table 1 above, the output size of f(·) is d=640.

[0109] The training of the embedding network 430 is done using the Euclidean triplet loss derived in Schroff (supra). This is now described in more detail.

[0110] The embedding network 430 does not learn from any ground truth, but compares its outputs of different samples for deriving the loss. For the loss calculation of the embedding network, three byte strings are used. The first two byte strings are byte strings of the first length (e.g., 1024 bytes) of different samples from the same malware family at the same starting index. These two samples are the anchor sample and the positive sample. The anchor sample is denoted as x a , the positive sample is denoted as x p .

[0111] The third byte string is a random byte string from the harmless sample. The third byte string is a negative sample and is denoted as x nUsing harmless samples as negative samples for training is a non-trivial decision. In previous work on malware family detection using similarity loss, the motivation for model training was to find similarities in malware families, while the motivation for training the embedding network 430 was to find similarities in byte string functionality. Using harmless software as negative samples ensures different functionality between negative samples and positive samples.

[0112] The triplet loss is calculated by finding the difference in distance between the anchor sample, the positive sample, and the negative sample. The motivation for this loss is to train the embedding network 430 to output embeddings that are close to each other in Euclidean space (if they have similar functions), and embeddings that are separated from each other (if they have different functions).

[0113] The set of single anchor samples, positive samples, and negative samples is called a triplet pair. At each training step, the embedding network 430 is trained on the loss of a batch of triplet pairs of length b. The batch is denoted as in For a single training step, the loss L can be calculated according to Equation (5).

[0114]

[0115] where α is the enforced margin between positive and negative pairs. Since the distance function in the loss is unbounded (the range of the Euclidean distance is ), so learning on all triple differences slows down convergence. The constant α ensures that only triple differences within a certain interval are trained by the network. For embedding network 430 training, α=0.2 is chosen in one case due to its success in Schroff (supra). However, other values ​​are also possible.

[0116] In some cases, the embedding network 430 is trained using the Adam stochastic gradient descent method described in DPP Kingma et al., "Adam: A method for stochastic optimization", arXiv preprint arXiv:1412.6980, 2014, the contents of which are incorporated herein by reference. In this example, the embedding network model is trained with a learning rate of 0.0001 for 10 epochs.

[0117] Therefore, as shown at arrow 432, equation (5) can be used to calculate the triplet loss for training the embedding network 430.

[0118] Gym Environment

[0119] The gym environment is used to help the network generalize. Given an embedding network, a training set, and a support set, the gym environment uses RL techniques to further train the embedding network.

[0120] In previous work, and in evaluating Figure 4 In the embedding network 430 system, it is found that the embedding network is strong in creating similar embeddings for samples in the same family, but fails to create large distances between samples from different families. To help with the problem of embedding separation, the embedding network 430 can be trained in a simulated deployment gym.

[0121] Reference now Figure 5 , which shows a gym environment 500. The gym environment 500 is an auxiliary training for the embedding network 430, used to promote generalization on different families.

[0122] Given an embedding network 430 denoted as f(·), a training set, and a support set, an EM scheme may be employed to train the network. EM is a two-step algorithm for estimating the basis parameters of a distribution, as described, for example, in T. Moon, "The expectation-maximization algorithm", IEEE Signal Processing Magazine, vol. 13, no. 6, pp. 47-60, 1996, the contents of which are incorporated herein by reference. In this case, the distribution is the probability distribution of the training samples within each family for the support set. The network f(·) is an estimator of the probability distribution optimized by the EM learning process. In particular, the distribution that the system attempts to estimate can be considered a perfect malware embedder. Given that neither the training set nor the support set has a perfect embedding, an EM scheme may be required to iteratively train the network for family classification.

[0123] First, a probability distribution for each training sample in the batch is found and the probability distribution is trained into the network. Second, after each training epoch, the embedding network f(·) can produce more accurate embeddings, so each byte string in the support set is embedded with the updated parameters of f(·), and training continues. Since both the training set and the support set are estimates of the unknown distribution, such an algorithm may be desirable for training.

[0124] Therefore, in Figure 5 In , given a collected malware corpus 510, the set selection process 520 includes picking two different variants from the same family from a random family. These are shown as a first variant 522 and a second variant 532.

[0125] The first variant 522 is segmented at block 524 and the second variant 532 is segmented at block 534. A support set 526 and a training set 536 are generated from the byte strings.

[0126] The gym environment 500 embeds all samples in the support set 526 and stores them for training. In addition, the gym environment 500 embeds the samples in the training set 526 in batches. For each batch of training samples, the gym environment 500 loss is derived and propagated through the embedding network f(·). Once all training batches have been evaluated, the embedding network f(·) embeds the support set with the newly trained parameters. This iteration of training matches the iteration of the EM system. The set selection process 520 is therefore repeated to create large and diverse training and support sets.

[0127] The embedding network 430 can be pre-trained, for example using Figure 4 Embodiment of the invention.

[0128] The embedding network 430 then embeds the support set 526 , as shown at block 540 .

[0129] The network 430 then embeds batches of the training set 536 , as shown at box 550 .

[0130] At box 554, a neighbor search is performed on the support set 526 on each sample in the training batch. A reward is then calculated for batch matching and propagated through the embedding network 430 as shown by arrow 556.

[0131] In particular, for the gym environment 500 training process, a new EM loss can be defined. Since the approximate probability distribution is not differentiable, a reinforcement learning method can be adopted to create a reward based on the probability distribution of each training sample. For the gym environment 500 training, the support set of n sets of malware families is used Each is the set of embeddings from malware family i. For a given training sample s in malware family 0≤t≤n, the reward is the probability that the sample s is in family t. To find this probability, the family minimum distance function m(·,·) can be defined according to Equation (6).

[0132]

[0133] where a is a single embedding, and is a set of malware embeddings. For sample s in family t, the family minimum vector m can be found according to equation (7).

[0134]

[0135] The value in index i of vector m is the value of the training sample s and the malware family The family probability vector p can be calculated according to Equation (8).

[0136] p=||m|| (8)

[0137] This normalizes the family's minimum vector so that the sum of all elements in p is 1, making each element p i The probability of sample s being in family i. The reward for training sample s is r = p t The loss propagated into the network is 1-r. As described above, the loss is averaged over the batches before being propagated through the network.

[0138] In the experiments, the gym environment is trained using the Adam stochastic gradient descent method with a learning rate of 0.000001 for 100 epochs and 500 training processes.

[0139] Reference again Figure 5 , a batch neighbor search is performed on the entire training set 536, as shown by box 560. In addition, at the end of training from the entire set, the support set 526 is embedded using the updated embedding network 430, and training continues, as shown by box 570.

[0140] Two example training algorithms for the gym environment 500 are shown below in Table 2 and Table 3. Table 2 shows the expectation algorithm and Table 3 shows the maximization algorithm.

[0141]

[0142] Table 2: Training Gym environment expectation algorithm

[0143] For the desired algorithm, the test set and support set are used together with the embedding function and the selected optimizer. As discussed above, the embedding function is the embedding network 430, and the optimization algorithm is Adam.

[0144] In Table 2, row 1 loops through each batch of data in the training set.

[0145] Row 2 of Table 2 initializes the loss variable L.

[0146] Line 3 iterates over each sample b in batch B.

[0147] Line 4 initializes the distribution to an empty array.

[0148] Line 5 iterates over each family in the support set.

[0149] Line 6 finds the shortest distance between the test sample and all embeddings in family F. This shortest distance is then added to the family distribution.

[0150] Line 8 normalizes the distribution using the Euclidean ordered normalization algorithm.

[0151] Row 9 of Table 2 calculates the reward for sample b by finding the probability of sample b being in the correct family from the family distribution D.

[0152] Line 10 calculates the loss from the reward.

[0153] Line 11 adds the sample loss to the batch loss set.

[0154] Line 13 updates the weights of the embedding function f from the batch of data, the loss, and the optimizer.

[0155] Line 15 returns the embedding function with the new weights.

[0156]

[0157] Table 3: Training gym environment maximization algorithm

[0158] Table 3 is the maximization step of the EM algorithm. Given the embedding function, family size, and support superset, generate the support set for training.

[0159] In Table 3, row 1 initializes the support set S.

[0160] Line 2 iterates over each family in the support superset.

[0161] Line 3 initializes the family set F.

[0162] Line 4 takes a random sample of size X from the family F′.

[0163] Line 5 iterates over each sample in family F′.

[0164] Line 6 embeds the sample.

[0165] Line 7 adds the embedding to the family F.

[0166] Line 9 adds the family set to the support set S.

[0167] Line 11 returns the updated support set used for training in the algorithm of Table 2.

[0168] Therefore, the first step of EM training is to initialize the first support set using the algorithm in Table 3.

[0169] From the above, the training of the embedding network can be done in two stages, using Figure 4 and Figure 5 An embodiment is shown.

[0170] deploy

[0171] Once the training is complete, the embedding network can be used in a deployment scenario to classify malware and find zero-day malware samples. Figure 6 .

[0172] Figure 6 A matching system 600 is shown, which is an open set approximate nearest neighbor search algorithm built on the Hierarchical Navigable Small Worlds (HNSW) by Malkov (supra).

[0173] exist Figure 6 In the example of , an unknown malware sample 610 is provided to the matching system 600. Specifically, at block 620, the malware sample 610 is segmented into a given length. The given length is the same as the length used to train the embedding network 430.

[0174] At block 630, the segmented byte strings are organized for embedding.

[0175] The organized, segmented byte strings are then passed through an embedding network 430 to generate an embedding for each byte string of a set length in the malware sample.

[0176] For each embedding in embeddings, a first nearest neighbor is found at block 650 .

[0177] At block 660, zero-day classification is done on the unknown byte string based on the embedding. In particular, for each nearest neighbor, if the neighbor is outside a predetermined known threshold τ, the class of the byte string is set to "unknown".

[0178] Then, at block 670, the process may set the predicted class of the malware sample by fusion of majority voting decisions on the classes of the embedded byte strings.

[0179] Figure 6 This process allows for rapid classification of malware that does not require greater than first order computations for zero-day classification of byte strings.

[0180] Malkov (supra) proposed an approximate K nearest neighbor search based on a navigable small-world graph with a controllable hierarchy. A navigable small-world network is a network with logarithmic or algorithmic scaling of a greedy graph routine, as described, for example, in JM Kleinberg, "Navigation in a small world", Nature, vol. 406, no. 6798, pp. 845-845, 2000 and in et al., “Navigability of complex networks”, CoRR, vol. abs / 0709.0303, 2007, the contents of both of which are incorporated herein by reference.

[0181] Embedding and sum of known byte strings Figure 6 The process of box 650 of the system of is expanded on Malkov (supra). Specifically, the embedding of known byte strings is constructed by iteratively inserting the embedded malware byte strings to construct a graph structure. The insertion of a single embedding is as follows. Starting at the highest level of the graph, a greedy algorithm is used to find the nearest neighbors of the incoming embedding. Then, after the connection from the previously found nearest neighbors, the insertion algorithm moves to find the nearest neighbors of the next layer. This process continues for all layers in the hierarchy. The greedy algorithm from Malkov (supra) builds on the algorithm from Y. Malkov, "Approximate nearest neighbor algorithm based on navigable small worldgraphs", Inf. Syst., vol. 45, pp. 61-68, 2014. [Malkov-2] ("Approximate nearest neighbor algorithm based on navigable small world graphs", Inf. Syst., vol. 45, pp. 61-68, 2014, [Malkov-2]) The contents of which are incorporated herein by reference.

[0182] Once all levels in the hierarchical graph have been evaluated, incoming samples are connected to the nearest neighbors found in the iterative search process. In some cases, a greedy algorithm finds a single nearest neighbor at each level of the hierarchy. Similarly, the Euclidean distance for measuring the distance of samples in the graph can be used following the Euclidean distance loss used to train the embedding network system.

[0183] Therefore, as provided above, incoming malware samples 610 are preprocessed by segmenting, organizing, and using the embedding network 430 to embed the malware sample byte strings into the same vector space as the stored malware embeddings. For each byte string in the incoming sample, the byte string is embedded and awaits classification.

[0184] For each embedding generated for a single sample, the process of block 650 is run. For each embedding, the classification and distance between the incoming embedding and its nearest neighbor are saved.

[0185] Regarding the zero-day classification at box 660, if the incoming sample is outside the boundaries of the known malware embedding, it is classified as a zero-day sample. For an embedding, if the distance between the embedding and its nearest neighbor is greater than the chosen τ, the classification of the embedding is set to "unknown".

[0186] Furthermore, with respect to block 670, this block provides decision fusion of embedded classifications. Given all embedded classifications for a malware sample, the most prevalent classification is set as the predicted classification for the sample.

[0187] In a real-world setting, once a sample has been classified, all embeddings are added to the matching system graph, with the predicted class as the ground truth classification. For evaluating the system, no test samples were added to the graph after classification. For evaluation, τ = 0.01 was used in one case. However, other values ​​may be used in other cases.

[0188] If the sample is classified as "zero day" at block 670, it may be flagged for action. The action may, for example, be brought to the attention of a malware researcher for study. This may be used to determine the origin, nature, impact, or behavior of the malware. The action may be used in the development of detection algorithms to detect and / or prevent malware, such as for anti-virus programs. The action may be used in the creation of malware removal algorithms to remove malware, among other actions.

[0189] experiment

[0190] Figure 4 , Figure 5 and Figure 6 The process was tested using real-world data. Three different data sets were used to conduct validity experiments on the methods and systems of the present disclosure. Specifically, multiple data sets of data categorized in chronological order were used.

[0191] In addition, four experiments were conducted to check the effectiveness of the system and method. The first two experiments were conducted to show that the system and method can be generalized to different malware families. The last two experiments are used to show whether the system and method can reliably separate known malware families from unknown malware families. In addition, multiple state-of-the-art ML methods and twin-based malware family detection methods are compared with the system and method in family matching capabilities.

[0192] In total, three different datasets are used for training and evaluating the present system and method. The first dataset is a training dataset, training-2021, and is a batch of real-world malware samples identified in 2021 and harmless samples from different years.

[0193] The second and third datasets are test datasets. The two test sets are datasets of malware identified in the first and second quarters of 2022.

[0194] The data is separated chronologically to better simulate a real-world malware classification environment. Figure 7 A visualization of the data set can be seen in . However, as will be appreciated by those skilled in the art, the use of such a data set and structure is merely an example, and the embodiments of the present disclosure may equally be used with other data sets and other data structures.

[0195] exist Figure 7 In the embodiment of the present invention, a malware corpus 710 and a harmless software corpus 712 are available in the system.

[0196] exist Figure 7 The training dataset 720 in the example includes malware found in 2021, which is a corpus of malware and harmless software used to generate triple pairs for training the embedding network 430, and a test set and support set for training the gym environment 500. All malware samples in the training corpus are collected from the online repository Malware Bazaar. The harmless files used are collected from various online repositories.

[0197] The training data set 720 consists of 50,248 malware samples sampled from 175 families and 7,828 harmless samples from different software suppliers. All samples used are Windows portable executable files. As described above, harmless samples are only used to generate negative samples of triple pairs.

[0198] One million triples are generated from the corpus for embedding network 430 training. The triples are byte strings randomly sampled with replacement from the corpus of malware and harmless software. Figure 5As described, the gym environment 500 is trained using a support set and a test set. The support set is a malware-embedded dataset that will be used as a simulated malware repository that the cyber threat intelligence organization will use to compare incoming samples with known samples. For each of the 175 families in the training data, two samples are selected, and all byte strings of a set length (e.g., 1024 bytes) of the sample include the support set. Similarly, the test set is a set length byte string (e.g., 1024 bytes) of two samples randomly sampled from each family in the training data.

[0199] Two datasets are used to test the present system and method. For the experiments conducted, the datasets are malware samples identified in the first and second quarters of 2022, respectively.

[0200] As previously described, all malware used for training and for evaluating the efficacy of the present system and method was separated to better simulate a real-world environment. Due to the nature of the present system and method, two separate test sets were used. Specifically, the present system and method used a support set of samples stored for matching. The test set from the first quarter of the year was used as the support set, and the matching ability of the present system and method was tested on the second quarter data set.

[0201] The two datasets are further separated in the data between the in-sample and out-of-sample groups. Figure 7 Shown in the figure are test data set 740 representing the in-sample first quarter data set; test data set 742 representing the in-sample second quarter data set; test data set 750 representing the out-of-sample first quarter data set; and test data set 752 representing the out-of-sample second quarter data set.

[0202] The training dataset (training-2021) contains 175 families of malware. The in-sample test dataset 740 and the in-sample test dataset 742 contain samples from 25 families sampled from the 175 training families. The out-of-sample test dataset 750 and the out-of-sample test dataset 752 contain malware samples from the 25 families that are not in the training dataset 720.

[0203] This is further illustrated in Table 4, which shows a list of families and the number of samples of each family used in the in-sample test dataset.

[0204]

[0205] Table 4: In-sample clusters

[0206] Table 5 shows a list of families, and the number of samples of each family used in the out-of-sample testing dataset. As shown, there is no overlap in different malware samples between all discussed datasets.

[0207]

[0208] Table 5: Out-of-sample population

[0209] The present system and method (labeled as "present model" in the table below) is compared with eleven other methods for family matching. Three of the methods are the Malkov and Yashunin approximate nearest neighbor algorithms with different input data. The input data tested with Malkov and Yashunin are the original malware bytestrings, the malware bytestrings that are L2 normalized, and the malware bytestrings that are average pooled. These are shown in the table below as "HNSW"; "L2+HNSW" and "Average Pooling+L2+HNSW".

[0210] Five popular ML classifiers were also implemented for comparison with the present model. The ML methods compared with the Mecha system were quadratic discriminant analysis (QDA), as described, for example, in A. Tharwat, "Linear vs. quadratic discriminant analysis classifier: a tutorial", Int. J. Appl. Pattern Recognit., vol. 3, no. 2, pp. 145-180, 2016; Ada Boost, as described, for example, in Y. Freund et al., "A decision-theoretic generalization of on-line learning and an application to boosting", J. Comput. Syst. Sci., vol. 55, no. 1, pp. 119-139, 1997 ("Decision-theoretic generalization of online learning and its application in boosting", Journal of Computer Systems Science, Vol. 55, No. 1, pp. 119-139, 1997); decision trees, as described, for example, in L. Breiman et al., "Classification and Regression Trees", Wadsworth, 1984 ("Classification and Regression Trees", Wadsworth Publishing, 1984); random forests, as described, for example, in L. Breiman, "Random forests", Mach. Learn., vol. 45, no. 1, pp. 5-32, 2001 (("Random forests", Machine Learning, Vol. 45, No. 1, pp. 5-32, 2001)); and Gaussian Naive Bayes (NB), the contents of all of which are incorporated herein by reference. This approach is implemented to ensure that the present model has higher performance than conventional state-of-the-art ML-based classifiers.

[0211] The twin-based malware similarity network proposed by Hsiao et al. and Conti et al. was implemented to compare the classification ability in the twin network depending on the input data and output dimensionality. The two networks have input of two sample images and output a single similarity score. Therefore, the comparison between a single test sample and the entire support set requires significantly more time than all other methods used in the experiments.

[0212] Finally, there will be no Figure 5 Gym environment Figure 4 Examples and Figure 6Example (embedding + matching) with including all Figure 4 , Figure 5 and Figure 6 This was done as an ablation test to determine the impact of gym environment training on the classification capabilities of the present system and method.

[0213] All matching algorithms were given 24 hours to run, after which all results were predicted to be 0. To compare different methods, the metrics area under the ROC curve (AUC), accuracy, precision, recall and F1-score were used. Again, all metrics were calculated using the optimal threshold determined by calculating the ROC curve.

[0214] As provided above, four experiments were performed. The first two experiments on this model are used to verify the generalizability of the present system and method. A simulated real-world malware classification environment is performed using test data set 740 and test data set 750 as stored data and test data set 742 and test data set 752 as newly arrived samples. The experiment is performed twice, first using in-sample data 740 and in-sample data 742, and then using out-of-sample data 750 and out-of-sample data 752.

[0215] Along with verifying that the present system and method can reliably match unseen malware to the correct family, this experiment verifies that the training process for the present system and method does not overfit the embedding network 430 to the training family. This experiment is called in-sample generalizability and out-of-sample generalizability.

[0216] The last two experiments are used to verify the zero-day detection capability of the system and method.

[0217] The third experiment is used to validate zero-day detection as a binary classification problem. Given a sample, the task of the system and method is to classify malware as known or unknown.

[0218] The fourth experiment validates zero-day family detection in a full malware classification simulation environment. Given an input sample, the task of the present system and method is to classify the sample into a known malware family or to classify the sample as unknown. For this experiment, the test data set 740 is simulated stored data, and the in-sample test data set 742 and the out-of-sample test data set 752 are both newly arrived samples.

[0219] result

[0220] The results for the two generalization experiments can be seen below in Table 6 and Table 7. Specifically, Table 6 shows the generalization experiment for in-sample data and Table 7 shows the generalization experiment for out-of-sample data.

[0221]

[0222] Table 6: Results of matching Q2 on the in-sample data of Q1

[0223] As can be seen from Table 6, the present model performs exceptionally well in classifying the trained malware samples, with an AUC of 0.9982 and an accuracy of 0.9984. This demonstrates the ability of the present model to accurately match malware variants to the correct family.

[0224] Likewise, as can be seen in Table 6, ablation tests show performance enhancement from training in the generalized RL gym environment 500.

[0225] For F1, precision, and recall, the present model performs with the highest values ​​in all three metrics. This further shows the balance of the present model when matching the correct samples and an indication when the two samples are not from the same family.

[0226] For sample inference time, the fastest model is the decision tree baseline, which has a sample inference time of 0.0276 seconds compared to 0.6150 seconds for the present model. Also, it can be seen that the embeddings from the present model have a significantly lower average embedding distance than other distance-based evaluation tools, further demonstrating the embedding capabilities of the embedding network 430 and gym environment 500 training.

[0227] During the classification of each malware family by the present model on the in-sample data, the only families with significant mismatches of the samples were the "a310logger" family and the "comminer" family.

[0228] The results are shown in Table 7 for the out-of-sample data.

[0229]

[0230] Table 7: Results of matching Q2 on Q1 out-of-sample data

[0231] As can be seen from Table 7, our model has the best performance with an AUC of 0.9980 and an accuracy of 0.9962. Unlike the in-sample experiments, the embedding and matching baselines are not suboptimal models. In the out-of-sample experiments, the suboptimal model is QDA with an AUC of 0.9894 and an accuracy of 0.9924. In terms of F1, precision, and recall, our model outperforms QDA with significantly higher accuracy.

[0232] Similar to the in-sample test, our model has the shortest average embedding distance. However, our model does not have the lowest out-of-sample inference time. While our system is not the fastest among the baselines, the inference time per sample is not significantly higher and does produce more accurate results.

[0233] The classification results on the out-of-sample data only result in the “MyDoom” family being significantly misclassified, with a classification accuracy of 0.75.

[0234] Table 8 shows the results for zero-day detection as a binary classification problem experiment. Given a support set of malware samples, the model's task is to predict whether an incoming sample comes from a known family or an unknown family in the in-sample test dataset and the out-of-sample test dataset. If an incoming sample is outside a given threshold (τ) of its nearest neighbors, it is predicted as unknown.

[0235]

[0236] Table 8: Results of zero-day prediction

[0237] As can be seen from Table 8, the present model significantly outperforms all baselines in this experiment. Also, the present model has an AUC of 0.9962 and an accuracy of 0.9977, making the model very accurate in detecting whether an incoming sample is known to the system. In addition, F1, precision, and recall are almost all 1, with the lowest of the three being precision with a score of 0.9901.

[0238] Similar to previous experiments, sample inference time averaged half a second.

[0239] Table 9 shows the results of the zero-day family classification experiment.

[0240]

[0241] Table 9: Results of family classification with zero-day samples

[0242] Similar to all previous experiments, Table 9 shows that the present model has the best performance, with an AUC of 0.9978 and an accuracy of 0.9979. Likewise, F1, precision, and recall are all above 0.95, with the lowest metric being precision with a score of 0.9512.

[0243] The second best performing model is the Average Pooling + L2 + HNSW model with an AUC of 0.9719 and an accuracy of 0.9637. This is a better result than the Ablation Embedding Network + Matching, but still not as accurate as our model.

[0244] Table 9 shows the difference in performance between most models in binary classification and family classification experiments. For family classification, many models have previously shown the ability to classify known families, which leads to high success in zero-day family classification experiments. In the binary classification experiments, it is shown that almost all models have little ability to detect whether a sample is known or unknown to the model.

[0245] For the classification of families in the zero-day experiment, almost all unknown samples (0.9780) were correctly classified as unknown. The other unknown samples were classified as Danabot families.

[0246] Further evaluation on ablation studies between embedding and matching when compared with the entire system and method is presented in Figure 8 , Fig. 9 , Fig.10 and Fig.11 ROC curves for two of the four experiments can be seen in .

[0247] Specifically, Figure 8 The ROC curve for in-sample classification is shown. Figure 4 , Figure 5 and Figure 6 The present model of an embodiment of is represented by line 810, and the embedding and matching model is represented by line 812. The optimal ROC curve has an area under 1.0.

[0248] Fig. 9 The ROC curve for out-of-sample classification is shown. Figure 4 , Figure 5 and Figure 6 The present model of the embodiment of is represented by line 910, and the embedded and matched model is represented by line 912. Again, the optimal ROC curve has an area under 1.0.

[0249] Fig.10 The ROC curve for the zero-day binary classification is shown. Figure 4 , Figure 5 and Figure 6 The present model of the embodiment of is represented by line 1010, and the embedding and matching model is represented by line 1012. Again, the optimal ROC curve has an area under 1.0.

[0250] Fig.11 The ROC curve for zero-day classification is shown. Figure 4 , Figure 5 and Figure 6 The present model of the embodiment of is represented by line 1110, and the embedded and matched model is represented by line 1112. Again, the optimal ROC curve has an area under 1.0.

[0251] As can be seen from the figure, the present model system is closer to the ideal curve than the embedding + matching ablation model. This further verifies the help that the reinforcement learning environment provides to the model training of the present system and method.

[0252] Computing equipment

[0253] The above method can be implemented using any computing device or group of computing devices. Fig.12 A simplified diagram of a computing device is shown.

[0254] exist Fig.12 In the embodiment, the device 1200 includes a processor 1210 and a communication subsystem 1212, wherein the processor 1210 and the communication subsystem 1212 cooperate to perform the method of the above-described embodiments. In some embodiments, the communication subsystem 1212 may include, for example, multiple subsystems for different radio technologies.

[0255] Processor 1210 is configured to execute programmable logic that may be stored on device 1200 along with data and Fig.12 In the example of , the memory 1220 is shown as (stored in) memory 1220. The memory 1220 may be any tangible, non-transitory computer-readable storage medium storing instruction codes that, when executed by the processor 1210, cause the device 1200 to perform the method of the present disclosure. The computer-readable storage medium may be tangible or in a transient medium / non-transitory medium, such as an optical (e.g., CD, DVD, etc.), magnetic (e.g., tape), flash drive, hard drive, or other memory known in the art.

[0256] Alternatively, or in addition to memory 1220 , device 1200 may access data or programmable logic from an external storage medium, such as through communications subsystem 1212 .

[0257] The communication subsystem 1212 allows the device 1200 to communicate with other devices or network elements, and may vary based on the type of communication being performed. Additionally, the communication subsystem 1212 may include a variety of communication technologies, including any wired or wireless communication technology.

[0258] In some cases, device 1200 may include peripherals 1230, which may include, for example, input and output devices such as a monitor, keyboard, keypad, trackball, mouse, camera, speakers, etc. However, peripherals are optional, and in some cases, a computing device may simply provide processing and communicate the results of the processing.

[0259] In one embodiment, communication between the various elements of device 1200 may be through internal bus 1250. However, other forms of communication are possible.

[0260] The embodiments described herein are examples of structures, systems or methods with elements corresponding to the elements of the technology of the present application. This written description can enable those skilled in the art to manufacture and use embodiments with alternative elements corresponding to the elements of the technology of the present application. Therefore, the intended scope of the technology of the present application includes other structures, systems or methods that are not different from the technology of the present application described herein, and also includes other structures, systems or methods that are not substantially different from the technology of the present application described herein.

[0261] Although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in a sequential order, or that all illustrated operations be performed to achieve the desired results. In some scenarios, multitasking and parallel processing may be employed. In addition, the separation of various system components in the implementations described above should not be understood as requiring such separation in all implementations, and it should be understood that the described program components and systems as a whole may be integrated together in a single software product or packaged into multiple software products.

[0262] In addition, the techniques, systems, subsystems, and methods described and illustrated as discrete or separate in various implementations may be combined or integrated with other systems, modules, techniques, or methods. Other items shown or discussed as coupled to each other or directly coupled to each other or communicating with each other may be indirectly coupled or communicated through some interface, device, or intermediate component, whether electrically, mechanically, or otherwise. Other examples that may be determined and may be changed, replaced, and alternatively selected by those skilled in the art.

[0263] Although the above specific embodiments have shown, described, and pointed out the basic novel features of the present disclosure as applied to various implementations, it should be understood that those skilled in the art may make various omissions, substitutions, and changes to the form and details of the illustrated system. In addition, the order of the method steps is not implied by the order in which they appear in the claims.

[0264] When a message is sent to / from an electronic device, such an operation may not be immediate or directly from a server. They may be delivered synchronously or asynchronously from a server or other computing system infrastructure supporting the device / method / system described herein. The aforementioned steps may include synchronous / asynchronous communication to / from a device / infrastructure in whole or in part. In addition, the communication from the electronic device may be to one or more endpoints on the network. The endpoint may be served by a server, a distributed computing system, a stream processor, etc. A content delivery network (CDN) may also provide communication to an electronic device. For example, in addition to a typical server response, a server may also provide or indicate data for a content delivery network (CDN) to wait for downloading by an electronic device at a later time, such as subsequent activities of an electronic device. Therefore, data may be sent directly from a server or other infrastructure (such as a distributed infrastructure or CDN) as part of a system or separated from a system.

[0265] Typically, the storage medium may include any one or some combination of the following: a semiconductor memory device (such as a dynamic or static random access memory (DRAM or SRAM)), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), and flash memory; magnetic disks such as fixed disks, disks, and removable disks; another magnetic medium including a tape; an optical medium such as a compact disk (CD) or a digital video disk (DVD); or another type of storage device. Note that the instructions discussed above may be provided on one computer-readable or machine-readable storage medium, or alternatively, may be provided on multiple computer-readable or machine-readable storage media distributed in a large system that may have multiple nodes. Such computer-readable or machine-readable storage media are considered to be part of an article of manufacture (or an article of manufacture). An article of manufacture or an article of manufacture may refer to any manufactured single component or multiple components. One or more storage media may be located in the machine that runs the machine-readable instructions, or at a remote site from which the machine-readable instructions may be downloaded over a network for execution.

[0266] In the foregoing description, numerous details are set forth to provide an understanding of the subject matter disclosed herein. However, implementations may be practiced without some of these details. Other implementations may include modifications and variations to the details discussed above. The appended claims are intended to cover such modifications and variations.

Claims

1. A method at a computing device, comprising: Segmenting the malware sample into a plurality of byte strings, each byte string in the plurality of byte strings having a predetermined length; embedding each byte string of the plurality of byte strings into an embedding network to generate a plurality of embeddings; For each embedding in the plurality of embeddings, finding a nearest neighbor; as well as A predicted family for the malware sample is set based on a fusion of the nearest neighbors for each of the plurality of embeddings.

2. The method of claim 1, wherein when the nearest neighbor for an embedding is outside a predetermined threshold, the embedding is classified as unknown.

3. The method of claim 2, wherein when the fusion includes an unknown family, the malware sample is marked as a zero-day sample, the marking causing an action to be performed on the malware sample.

4. The method according to claim 1, further comprising: Prior to segmenting the malware sample, performing a first training on the embedding network, the first training comprising: Randomly select two malware samples from the malware family; Randomly select harmless software samples from the harmless software corpus; Segmenting each of the two malware samples and the harmless software sample into byte strings of the predetermined length; creating triple pairs of anchor samples and positive samples based on the byte strings from the two malware samples and negative samples based on the byte strings from the innocent software sample; and The embedding network is trained for a triplet loss based on the triplets.

5. The method of claim 4, wherein the two malware samples and the harmless software sample are original executables.

6. The method of claim 4, wherein the triplet loss is calculated based on: in, L is the loss, x a is the anchor point sample, x p is the positive sample, x n are the negative samples, b is the length of the batch of triplet pairs, and α is the enforced spacing between positive and negative pairs.

7. The method of claim 4, further comprising using a gym environment to perform a second training, the second training comprising: Create a training set by: randomly selecting a plurality of first malware samples from a corpus of malware samples; segmenting each first malware sample of the plurality of first malware samples into a plurality of training byte strings, each training byte string of the plurality of training byte strings having a predetermined length; as well as Organizing the plurality of training byte strings into the training set; Create a support set by: randomly selecting a plurality of second malware samples from the corpus of malware samples; segmenting each second malware sample in the plurality of second malware samples into a plurality of supporting byte strings, each supporting byte string in the plurality of supporting byte strings having a predetermined length; as well as organizing the plurality of supporting byte strings into the supporting set; Selecting a batch of the training set; The support set and batches of the training set are used to update the embedding network by establishing a reward for batch matching across the batches for the training set.

8. The method of claim 7, wherein batches of the support set and the training set are embedded using the embedding network.

9. The method of claim 8, wherein said establishing said reward comprises performing a batch neighbor search for said batches of said training set.

10. The method of claim 9, wherein said establishing said reward further comprises repeating a batch neighbor search over the entire training set.

11. A computing device comprising: processor; as well as Memory, The computing device is configured to: Segmenting the malware sample into a plurality of byte strings, each byte string in the plurality of byte strings having a predetermined length; embedding each byte string of the plurality of byte strings into an embedding network to generate a plurality of embeddings; For each embedding in the plurality of embeddings, finding a nearest neighbor; as well as A predicted family for the malware sample is set based on a fusion of the nearest neighbors for each of the plurality of embeddings.

12. The computing device of claim 11, wherein when the nearest neighbor for an embedding is outside a predetermined threshold, the computing device is further configured to classify the embedding as unknown.

13. The computing device of claim 12, wherein when the fusion includes an unknown family, the computing device is further configured to mark the malware sample as a zero-day sample, the marking causing an action to be performed on the malware sample.

14. The computing device of claim 11, wherein the computing device is further configured to: Prior to segmenting the malware sample, performing a first training on the embedding network, the first training comprising: Randomly select two malware samples from the malware family; Randomly select harmless software samples from the harmless software corpus; Segmenting each of the two malware samples and the harmless software sample into byte strings of the predetermined length; creating triple pairs of anchor samples and positive samples based on the byte strings from the two malware samples and negative samples based on the byte strings from the innocent software sample; as well as The embedding network is trained for a triplet loss based on the triplets.

15. The computing device of claim 14, wherein the two malware samples and the harmless software sample are both original executables.

16. The computing device of claim 14, wherein the triplet loss is calculated based on: in, L is the loss, x a is the anchor point sample, x p is the positive sample, x n are the negative samples, b is the length of the batch of triplet pairs, and α is the enforced spacing between positive and negative pairs.

17. The computing device of claim 14, wherein the computing device is further configured to use the gym environment to perform a second training, the second training comprising: Create a training set by: randomly selecting a plurality of first malware samples from a corpus of malware samples; segmenting each first malware sample of the plurality of first malware samples into a plurality of training byte strings, each training byte string of the plurality of training byte strings having a predetermined length; as well as Organizing the plurality of training byte strings into the training set; Create a support set by: randomly selecting a plurality of second malware samples from the corpus of malware samples; segmenting each second malware sample in the plurality of second malware samples into a plurality of supporting byte strings, each supporting byte string in the plurality of supporting byte strings having a predetermined length; as well as organizing the plurality of supporting byte strings into the supporting set; Selecting a batch of the training set; The support set and batches of the training set are used to update the embedding network by establishing a reward for batch matching across the batches for the training set.

18. The computing device of claim 17, wherein batches of the support set and the training set are embedded using the embedding network.

19. The computing device of claim 18, wherein the computing device is configured to establish the reward by performing a batch neighbor search for the batches of the training set.

20. The computing device of claim 19, wherein the computing device is configured to build up the reward by further repeating batch neighbor searches across the training set.

21. A computer readable medium storing instruction codes which, when executed by a processor of a computing device, cause the computing device to: Segmenting the malware sample into a plurality of byte strings, each byte string in the plurality of byte strings having a predetermined length; embedding each byte string of the plurality of byte strings into an embedding network to generate a plurality of embeddings; For each embedding in the plurality of embeddings, finding a nearest neighbor; as well as A predicted family for the malware sample is set based on a fusion of the nearest neighbors for each of the plurality of embeddings.

Images