Using file relationships in malware classification

摘要: Typical malware classification methods analyze unknown files in isolation. However, this ignores valuable relationships between files, such as containment a zip archive, dropping, or downloading. We present new system based on graph induced by file relationships, and, proof of concept, for which we have much available data. However our methodology is general, relying only an initial estimate some the data and propagating information along edges graph. It can thus be applied to other types relationships. show that since malicious are often included multiple containers, system's detection accuracy significantly improved, particularly at low false positive rates main operating points automated classifiers. For example rate 0.2%, negative decreases from 42.1% 15.2%. Finally, highly scalable; basic implementation learn good classifiers large, bipartite including over 719 thousand containers 3.4 million total 16 minutes.