A Comprehensive Study on Learning-Based PE Malware Family Classification Methods
Driven by the high profit, Portable Executable (PE) malware has been consistently evolving in terms of both volume and sophistication. PE malware family classification has gained great attention and a large number of approaches have been proposed. With the rapid development of machine learning techniques and the exciting results they achieved on various tasks, machine learning algorithms have also gained popularity in the PE malware family classification task. Three mainstream approaches that use learning based algorithms, as categorized by the input format the methods take, are image-based, binary-based and disassembly-based approaches. Although a large number of approaches are published, there is no consistent comparisons on those approaches, especially from the practical industry adoption perspective. Moreover, there is no comparison in the scenario of concept drift, which is a fact for the malware classification task due to the fast evolving nature of malware. In this work, we conduct a thorough empirical study on learning-based PE malware classification approaches on 4 different datasets and consistent experiment settings. Based on the experiment results and an interview with our industry partners, we find that (1) there is no individual class of methods that significantly outperforms the others; (2) All classes of methods show performance degradation on concept drift (by an average F1-score of 32.23%); and (3) the prediction time and high memory consumption hinder existing approaches from being adopted for industry usage.
Code (1)
Tasks
ClassificationMalware ClassificationSimilar Papers 제목 키워드 기반
Enhancing Efficiency and Privacy in Memory-Based Malware Classification through Feature Selection
Malware poses a significant security risk to individuals, organizations, and critical infrastructure by compromising systems and data. Leveraging memory dumps that offer snapshots of computer memory can aid the analysis …
Classificationfeature selectionMalware ClassificationIntegration of Static and Dynamic Analysis for Malware Family Classification with Composite Neural Network
Deep learning has been used in the research of malware analysis. Most classification methods use either static analysis features or dynamic analysis features for malware family classification, and rarely combine them as …
ClassificationGeneral ClassificationMalware AnalysisMalware ClassificationRethinking and Exploring String-Based Malware Family Classification in the Era of LLMs and RAG
Malware family classification aims to identify the specific family (e.g., GuLoader or BitRAT) a malware sample may belong to, in contrast to malware detection or sample classification, which only predicts a Yes/No outcom…
Malware DetectionMalMixer: Few-Shot Malware Classification with Retrieval-Augmented Semi-Supervised Learning
Recent growth and proliferation of malware have tested practitioners ability to promptly classify new samples according to malware families. In contrast to labor-intensive reverse engineering efforts, machine learning ap…
Data AugmentationMalware ClassificationRetrievalMOTIF: A Large Malware Reference Dataset with Ground Truth Family Labels
Malware family classification is a significant issue with public safety and research implications that has been hindered by the high cost of expert labels. The vast majority of corpora use noisy labeling approaches that …