With the growing number of malware and cyber attacks, there is a need for "orthogonal" cyber defense approaches, which are complementary to existing methods by detecting unique malware samples that are not predicted by other methods. In this paper, we propose a novel and orthogonal malware detection (OMD) approach to identify malware using a combination of audio descriptors, image similarity descriptors and other static/statistical features. First, we show how audio descriptors are effective in classifying malware families when the malware binaries are represented as audio signals. Then, we show that the predictions made on the audio descriptors are orthogonal to the predictions made on image similarity descriptors and other static features. Further, we develop a framework for error analysis and a metric to quantify how orthogonal a new feature set (or type) is with respect to other feature sets. This allows us to add new features and detection methods to our overall framework. Experimental results on malware datasets show that our approach provides a robust framework for orthogonal malware detection.
翻译:随着恶意软件和网络攻击数量的不断增加,有必要采用“orthogonal”网络防御方法,这些方法与现有方法相辅相成,通过发现独特的恶意软件样本,而其他方法没有预测到。在本文中,我们建议采用新颖和正正反式的恶意软件检测方法,使用声描述器、图像相似描述器和其他静态/统计特征组合,来识别恶意软件。首先,当恶意软件二进制软件被作为音频信号时,我们展示了音频描述器在对恶意软件家庭进行分类方面的有效性。然后,我们展示了在声音描述器上所作的预测与图像相似描述器和其他静态特征的预测是正反向的。此外,我们开发了一个错误分析框架和一个计量新特征集(或类型)如何或正反调新特征集(或类型)的计量尺度。这使我们能够在总体框架中添加新的特征和检测方法。关于恶意软件数据集的实验结果显示,我们的方法为图像相似描述提供了强有力的框架。