Hierarchical learning for automated malware classification

Shayok Chakraborty, Jack W. Stokes, Lin Xiao, Dengyong Zhou, Mady Marinescu, Anil Thomas

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

2 Scopus citations

Abstract

Despite widespread use of commercial anti-virus products, the number of malicious files detected on home and corporate computers continues to increase at a significant rate. Recently, anti-virus companies have started investing in machine learning solutions to augment signatures manually designed by analysts. A malicious file's determination is often represented as a hierarchical structure consisting of a type (e.g. Worm, Backdoor), a platform (e.g. Win32, Win64), a family (e.g. Rbot, Rugrat) and a family variant (e.g. A, B). While there has been substantial research in automated malware classification, the aforementioned hierarchical structure, which can provide additional information to the classification models, has been ignored. In this paper, we propose the novel idea and study the performance of employing hierarchical learning algorithms for automated classification of malicious files. To the best of our knowledge, this is the first research effort which incorporates the hierarchical structure of the malware label in its automated classification and in the security domain, in general. It is important to note that our method does not require any additional effort by analysts because they typically assign these hierarchical labels today. Our empirical results on a real world, industrial-scale malware dataset of 3.6 million files demonstrate that incorporation of the label hierarchy achieves a significant reduction of 33.1% in the binary error rate as compared to a non-hierarchical classifier which is traditionally used in such problems.

Original languageEnglish
Title of host publicationMILCOM 2017 - 2017 IEEE Military Communications Conference
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages23-28
Number of pages6
ISBN (Electronic)9781538605950
DOIs
StatePublished - Dec 7 2017
Externally publishedYes
Event2017 IEEE Military Communications Conference, MILCOM 2017 - Baltimore, United States
Duration: Oct 23 2017Oct 25 2017

Publication series

NameProceedings - IEEE Military Communications Conference MILCOM
Volume2017-October

Conference

Conference2017 IEEE Military Communications Conference, MILCOM 2017
Country/TerritoryUnited States
CityBaltimore
Period10/23/1710/25/17

Keywords

  • Automated Malware Classification
  • Hierarchical Machine Learning

Fingerprint

Dive into the research topics of 'Hierarchical learning for automated malware classification'. Together they form a unique fingerprint.

Cite this