Portable, Data-Driven Malware Detection using Language Processing and Machine Learning Techniques on Behavioral Analysis Reports
ElMouatez Billah Karbab Mourad Debbabi




 

Concordia University, Montreal, Canada
e_karbab@encs.concordia.ca


    In response to the volume and sophistication of malicious software or
    malware, security investigators rely on dynamic analysis for malware
    detection to thwart obfuscation and packing issues. Dynamic analysis is the
    process of executing binary samples to produce reports that summarise their
    runtime behaviors. The investigator uses these reports to detect malware
    and attribute threat type leveraging manually chosen features. However, the
    diversity of malware and the execution environments makes manual approaches
    not scalable because the investigator needs to manually engineer
    fingerprinting features for new environments. In this paper, we propose,
    MalDy (mal die), a portable (plug and play) malware detection and family
    threat attribution framework using supervised machine learning techniques.
    The key idea of MalDy of portability is the modeling of the behavioral reports
    into a sequence of words, along with advanced natural language processing
    (NLP) and machine learning (ML) techniques for automatic engineering of
    relevant security features to detect and attribute malware without the
    investigator intervention. More precisely, we propose to use
    bag-of-words (BoW) NLP model to formulate the behavioral reports.
    Afterward, we build ML ensembles on top of BoW features. We extensively
    evaluate MalDy on various datasets from different platforms (Android and
    Win32) and execution environments. The evaluation shows the effectiveness
    and the portability MalDy across the spectrum of the analyses and settings. 



Malware, Android, Win32, Behavioral Analysis, Machine Learning, NLP






§ INTRODUCTION
 


Malware investigation is an important and time consuming task for security
investigators. The daily volume of malware raises the automation necessity of
the detection and threat attribution tasks. The diversity of platforms and
architectures makes the malware investigation more challenging. The
investigator has to deal with a variety of malware scenarios from Win32 to
Android. Also, nowadays malware targets all CPU architectures from x86 to ARM
and MIPS that heavily influence the binary structure. The diversity of malware
adopts the need for portable tools, methods, and techniques in the toolbox of
the security investigator for malware detection and threat attribution.

Binary code static analysis is a valuable tool to investigate malware in
general. It has been used effectively and efficiently in many solutions
<cit.>, <cit.>, <cit.>,
<cit.>, and <cit.> in
PC and Android realms. However, the use of static analysis could be problematic
on heavily obfuscated and custom packed malware. Solutions, such as
<cit.>, address those issues partially but they are
platform/architecture dependent and cover only simple evading techniques. On
the other hand, the dynamic analysis solutions <cit.>,
<cit.>, <cit.>,
<cit.>, <cit.>,
<cit.>, <cit.>,
<cit.>, <cit.>,
<cit.> show more robustness to evading techniques such as
obfuscation and packing. Dynamic analysis's main drawback is its hungry to
computation resources <cit.>, <cit.>. Also,
it may be blocked by anti-emulation techniques, but this is less common
compared to the binary obfuscation and packing. For this reason, dynamic (also
behavioral) analysis is still the default choice and the first analysis for
malware by security companies. 



The static and behavioral analyses are sources for security features, which the
security investigator uses to decide about the binary maliciousness. Manual
inspection of these features is a tedious task and could be automated using
machine learning techniques. For this reason, the majority of the
state-of-the-art malware detection solutions use machine learning
<cit.>, <cit.>. We could classify these
solutions' methodologies into supervised and unsupervised. The supervised
approach, such as <cit.> for Win32 and
<cit.>, <cit.> for Android, is the most
used in malware investigation <cit.>,
<cit.>. The supervised machine learning process starts by
training a classification model on a train-set. Afterward, we use this model on
new samples in a production environment. Second, the unsupervised approach,
such as <cit.>, <cit.>,
<cit.>, <cit.>,
<cit.>, in which the authors cluster the malware samples into
groups based on their similarity. Unsupervised learning is more common in
malware family clustering <cit.>, and it is less common in
malware detection <cit.>.

In this paper, we focus on supervised machine learning techniques along with
behavioral (dynamic or runtime) analyses to investigate malicious software.
Dynamic and runtime analyses execute binary samples to collect their behavioral
reports. The dynamic analysis makes the execution in a sandbox environment
(emulation) where malware detection is an off-line task. The runtime analysis
is the process of collecting behavioral reports from production machines. The
security practitioner aims to obtain these reports to make an online malware
checking without disturbing the running system. 



 §.§ Problem Statement
 


The state-of-the-art solutions, such as in <cit.>,
<cit.>, <cit.>, rely on manual
security features investigation in the detection process. For example,
StormDroid <cit.> used Sendsms and Recvnet
dynamic features, which have been chosen base on a statistical analysis, for
Android malware detection. Another example, the authors in
<cit.> used explicit features to build behavior's graphs
for Win32 malware detection . The security features may change based on the
execution environment despite the targeted platform. For instance, the authors
<cit.> and <cit.> used different
security features due to the difference between the execution environments. In
the context of the security investigation, we are looking for a portable
framework for malware detection based on the behavioral reports across a
variety of platforms, architectures, and execution environments. The security
investigator would rely on this plug and play framework with a minimum effort.
We plug the behavioral analysis reports for the training and apply (play) the
produced classification model on new reports (same type) without an explicit
security feature engineering as in <cit.>,
<cit.>, <cit.>; and this process works
virtually on any behavioral reports.  



 §.§ MalDy
 


We propose, MalDy, a portable and generic framework for malware detection and
family threat investigation based on behavioral reports. MalDy aims to be a
utility on the security investigator toolbox to leverage existing behavioral
reports to build a malware investigation tool without prior knowledge regarding
the behavior model, malware platform, architecture, or the execution
environment. More precisely, MalDy is portable because of the automatic mining
of relevant security features to allow moving MalDy to learn new environments'
behavioral reports without a security expert intervention.  Formally,
MalDy framework is built on top natural language processing (NLP) modeling and
supervised machine learning techniques. The main idea is to formalize the
behavioral report,  agnostically to the execution environment, into a bag of
words (BoW) where the features are the reports' words. Afterward, we leverage
machine learning techniques to automatically discover relevant security
features that help differentiate and attribute malware. The result is MalDy,
portable (Section <ref>), effective (Section
<ref>), and efficient (Section
<ref>) framework for malware investigation.



 §.§ Result Summary
 


We extensively evaluate MalDy on different datasets, from various platforms,
under multiple settings to show the framework portability, effectiveness,
efficiency, and its suitability for general purpose malware investigation.
First, we experiment on Android malware behavioral reports of MalGenome
<cit.>, Drebin <cit.>, and Maldozer
<cit.> datasets along with benign samples from AndroZoo
<cit.> and PlayDrone
[https://archive.org/details/android_apps] repositories. The reports
were generated using Droidbox <cit.> sandbox. MalDy achieved
99.61%, 99.62%, 93.39% f1-score on the detection task on the previous
datasets respectively. Second, we apply MalDy on behavioral reports (20k
samples from 15 Win32 malware family) provided by ThreatTrack
security [https://www.threattrack.com] (ThreatAnalyzer sandbox).
Again, MalDy shows high accuracy on the family attribution task, 94.86%
f1-score, under different evaluation settings. Despite the difference between
the evaluation datasets, MalDy shows high effectiveness under the same
hyper-parameters with minimum overhead during the production, only 0.03 seconds
runtime per one behavioral report on modern machines. 



 §.§ Contributions




    
  * New Framework: We propose and explore a data-driven approach
        to behavioral reports for malware investigation (Section
        <ref>). We leverage a word-based security feature
        engineering (Section <ref>) instead of the manual
        specific security features to achieve high portability across different
        malware platforms and settings.

    
  * BoW and ML: We design and implement the proposed framework
        using the bag of words (BoW) model (Section
        <ref>) and machine learning (ML) techniques
        (Section <ref>). The design is inspired from
        NLP solutions where the word frequency is the key for feature
        engineering.

    
  * Application and Evaluation: We utilize the proposed
        framework for Android Malware detection using behavioral reports from
        DroidBox <cit.> sandbox (Section <ref>).
        We extensively evaluate the framework on large reference datasets
        namely, Malgenome <cit.>,  Drebin
        <cit.>, and Maldozer <cit.> (Section
        <ref>). To evaluate the portability, we conduct a further
        evaluation on Win32 Malware reports (Section
        <ref>) provided by a third-party security
        company. MalDy shows high accuracy in all the evaluation tasks.






§ THREAT MODEL
 

We position MalDy as a generic malware investigator tool. MalDy current design
considers only behavioral reports. Therefore, MalDy is by design resilient to
binary code static analysis issues like packing, compression, and dynamic
loading. MalDy performance depends on the quality of the collected reports. The
more security information and features are provided about the malware samples
in the reports the higher MalDy could differentiate malware from benign and
attribute to known families. The execution time and the random event generator
may have a considerable impact on MalDy because they affect the quality of the
behavioral reports. First, the execution time affect the amount of information
in the reports. Therefore, small execution time may result little information
to fingerprint malware. Second, random event generator may not produce the
right events to trigger certain malware behaviors; this loads to false
negatives. Anti-emulation techniques, used to evade Dynamic analysis,  
could be problematic for MalDy framework. However, this issue is related to the
choice the underlying execution environment. First, this problem is less
critical for a runtime execution environment because we collect the behavioral
reports from real machines (no emulation). This scenario presumes that all the
processes are benign and we check for malicious behaviors. Second, the security
practitioner could replace the sandbox tool with a resilient alternative since
MalDy is agnostic to the underlying execution environment.




§ OVERVIEW
 



The execution of a binary sample (or app) produces textual logs whether in a
controlled environment (software sandbox) or production ones. The logs, a
sequence of statements, are the result of the app events, this depends on the
granularity of the logs. Furthermore, each statement is a sequence of words
that give a more granular description on the actual app event. From a security
investigation perspective, the app behaviors are summarized in an execution
report, which is a sequence of statements and each statement is a sequence of
words. We argue that malicious apps have distinguishable behaviors from benign
apps and this difference is translated into words in the behavioral report.
Also, we argue that similar malicious apps (same malware family) behaviors are
translated to similar words. 

frame=tb,
  columns=flexible,
  basicstyle=,
  breaklines=true,
  tabsize=1



Nowadays, there are many software sandbox solutions for malware investigations.
CWSandbox (2006-2011) is one of the first sandbox solutions for production use.
Later, CWSandbox becomes ThreatAnalyzer
[https://www.threattrack.com/malware-analysis.aspx], owned by
ThreatTrack Security. TheatAnalyzer is a sandbox system for Win32 malware, and
it produces behavioral reports that cover most of the malware behavior aspects
such as a file, network, register access records. Figure
<ref> shows a snippet from a behavioral report
generated by ThreatAnalyzer. For android malware, we use DroidBox
<cit.>, a well-established sandbox environment based on Android
software emulator <cit.> provided by Google Android SDK
<cit.>. Running an app may not lead to a sufficient coverage of the
executed app. As such, to simulate the user interaction with the apps, we
leverage MonkeyRunner <cit.>, which produces random UI
actions aiming for a broader execution coverage. However, this makes the app
execution non-deterministic since MonkeyRunner generates random
actions. Figure <ref> shows a snippet from the
behavioral report generated using DroidBox.

frame=tb,
  columns=flexible,
  basicstyle=,
  breaklines=true,
  tabsize=1

