Exploiting Latent Attack Semantics for Intelligent Malware Detection.

摘要: Behavioral malware detectors promise to expose previously unknown and are an important security primitive. However, even the best behavioral suffer from high false positives negatives. In this paper, we address challenge of aggregating weak per-device in noisy communities (i.e., ones that produce alerts at unpredictable rates) into accurate robust global anomaly detector (GD). Our system - Shape GD combines two insights: Structural: actions such as visiting a website (waterhole attack) or membership shared email thread (phishing by nodes correlate well with spread, create dynamic neighborhoods were exposed same attack vector; Statistical: feature vectors corresponding true local have markedly different conditional distributions. We use amplify transient low-dimensional structure is latent high-dimensional but vary unpredictably, shape extract neighborhood-level features identify infected neighborhoods. Unlike prior works aggregate detectors' alert bitstreams cluster vectors, analyzes led (alert-FVs) separate positives. first filters these alert-FVs efficiently maps neighborhood's alert-FVs' statistical shapes scalar score. then acts neighborhood level training on benign program traces learn ShapeScore positive neighborhoods, classifying anomalous ShapeScores malicious. Shape detects early (~100 ~100K node for waterhole ~10 1000 phishing) robustly (with ~100% TP ~1% FP rates).