Beyond Labeling: Intuitive Capability Assessment of Malware using Network Behavioral Profiles

摘要: Malicious software is still a leading threat in cybersecurity. Anti-Virus (AV) companies are pivotal understanding and assigning labels to new malware samples. Currently, these the sole source of ground truth information available security community evaluate analysis methods. However, their adopted naming conventions known be inconsistent unverifiable. The also black box since they do not represent capabilities malware. We believe that we need white way determine based on behavior, rather than family labels. current state art capability assessment contains largely manual approaches. We propose novel method called MalPaCA, which for large part automates by clustering temporal behavior observed malware's network traces. MalPaCA uses traces most Internet carry out its objectives. In doing so, build behavioral profiles families significantly more descriptive names. an intuitive, visualization-based cluster evaluation obtained clusters. 1.1k samples collected wild. shows promising results: (i) It correctly discovers capabilities, such as port scans reuse Command Control servers; (ii) number discrepancies between clusters traditional designations; (iii) demonstrates effectiveness unlabeled using features producing false positive rate mere 8%.