AMAL: High-Fidelity, Behavior-Based Automated Malware Analysis and Classification

摘要: This paper introduces AMAL, an operational automated and behavior-based malware analysis labeling (classification clustering) system that addresses many limitations shortcomings of the existing academic industrial systems. AMAL consists two sub-systems, AutoMal MaLabel. provides tools to collect low granularity behavioral artifacts characterize usage file system, memory, network, registry, does by running samples in virtualized environments. On other hand, MaLabel uses those create representative features, use them for building classifiers trained manually-vetted training samples, classify into families similar behavior. also enables unsupervised learning, implementing multiple clustering algorithms grouping. An evaluation both based on medium-scale (4,000 samples) large-scale datasets (more than 115,000 samples)—collected analyzed over 13 months—show AMAL’s effectiveness accurately characterizing, classifying, grouping samples. achieves a precision 99.5 % recall 99.6 certain families’ classification, more 98 clustering. Several benchmarks, costs estimates measurements highlight support merits features AMAL.