Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

7/20/2016
12:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Improving Attribution & Malware Identification With Machine Learning

New technique may be able to predict not only whether unfamiliar, unknown code is malicious, but also what family it is and who it came from.

One of the cybersecurity promises of machine learning (particularly "deep learning") is that it can accurately identify malware nobody has ever seen before because of what it's learned about malware it's seen in the past. Konstantin Berlin, senior research engineer at Invincea Labs, is trying to take the techology further, so that organizations can get more information about unfamiliar code than simply "it's benign" or "it's malicious."

Berlin, who will be presenting his work next month at Black Hat, says security pros also want to know more about the malware family so they can plan their mitigation strategy accordingly. His technique, he says will do that, as well as improve malware triage and attribution by using new methods of recognizing similarities between malware samples. This can all be done in a customized way that enables each organization to choose what features and factors interest them most.

Berlin explains machine learning's difference to traditional signature-based anti-malware like this: If, for example, you want to predict the direction a rocket will go when it sets off, he says you don't necessarily need to learn the physics of propulsion and enter equations into the machine. You simply need to feed it lots of data of examples of rockets going off until it learns to accurately predict where the rockets will go. "Based upon millions of observations, it won't necessarily explain the rule, but it works in terms of prediction."

So, even if the machine has never seen something before, it will know it's malicious -- even if it doesn't know precisely why.

What Berlin wants to do, however, is give people more than just benign or malicious.

To do that, he's using a technique that improves the way security tools recognize what binary is similar to another -- and therefore how they are classified into families, attributed to malware authors, and tied to threat actors. 

According to Berlin, the current process usually used is expensive to develop, and requires periodic retuning that is done manually because organizations have their own sets of features they look for in malware binaries, their own weighting system for which features are most significant, and their own methods for minimizing the impact of those features that aren't important at all. Because of the costs and the labor, the retuning isn't done as often, and therefore it's more difficult to keep up with the pace of malware evolution.  

The method Berlin is presenting at Black Hat next month may not only improve accuracy but make the process cheaper, he believes. It uses a technique called supervised embedding, and is something the security world more commonly encounters in facial recognition.

Supervised embedding is a way to disregard malware samples' unimportant features, enhance their most important features, and re-map the distance between those malware samples. Distance thus mirrors "semantic sense" and similarity is measured by the features the security team has deemed are the most essential for their needs. So, if they're specifically interested in principally grouping malware by the likely threat actor, target industry, attack vector or attack type, they could. Any features of a file that are unrelated to whether it is malicious are automatically eliminated, says Berlin, "so the distances rely on the tradecraft of the malware."

It does not require a stack of signatures, but the technology does require a database of labels for all of these malware features. Berlin is using Microsoft's existing database of families and variants, but organizations could invest in creating their own bespoke database that truly zeroes in on the information they want.

"That's the beauty of machine learning," he says. "You train it for the task you want to accomplish."

This sort of system, this brain, is considerably lighter to carry around than a stack of signatures, too, says Berlin. This "statistical approach," requires less power than an "all or nothing" approach, he says. 

Related Content:

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5243
PUBLISHED: 2020-02-21
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent hea...
CVE-2019-14688
PUBLISHED: 2020-02-20
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial produc...
CVE-2019-19694
PUBLISHED: 2020-02-20
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the ...
CVE-2020-5242
PUBLISHED: 2020-02-20
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file whic...
CVE-2020-8601
PUBLISHED: 2020-02-20
Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located in the same directory.