Learning Explainable Representations of Malware Behavior

2021/06/23 by Paul Prasse, Jan Brabec, Prasse, Paul +9 · 1 citation
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #cs.CR #cs.LG

paper · pdf · doi:10.48550/arxiv.2106.12328

This is a pre-print of an article to appear in Machine Learning and Knowledge Discovery in Databases. ECML PKDD 2021

arxiv created 2021/06/23 · arxiv updated 2021/06/24

Abstract

We address the problems of identifying malware in network telemetry logs and providing indicators of compromise -- comprehensible explanations of behavioral patterns that identify the threat. In our system, an array of specialized detectors abstracts network-flow data into comprehensible network events in a first step. We develop a neural network that processes this sequence of events and identifies specific threats, malware families and broad categories of malware. We then use the integrated-gradients method to highlight events that jointly constitute the characteristic behavioral pattern of the threat. We compare network architectures based on CNNs, LSTMs, and transformers, and explore the efficacy of unsupervised pre-training experimentally on large-scale telemetry data. We demonstrate how this system detects njRAT and other malware based on behavioral patterns.

Cited by

• Tiny Enough to Break In: Agentic Remote Access Trojans Powered by Small Language Models

Related

• Foundational Models for Malware Embeddings Using Spatio-Temporal Parallel Convolutional Networks
• RADAR: A TTP-based Extensible, Explainable, and Effective System for Network Traffic Analysis and Malware Detection
• A Novel Study on Intelligent Methods and Explainable AI for Dynamic Malware Analysis
• Robust Neural Malware Detection Models for Emulation Sequence Learning
• Learning Malware Representation based on Execution Sequences