Visible to the public Fast Model Learning for the Detection of Malicious Digital Documents

TitleFast Model Learning for the Detection of Malicious Digital Documents
Publication TypeConference Paper
Year of Publication2017
AuthorsScofield, Daniel, Miles, Craig, Kuhn, Stephen
Conference NameProceedings of the 7th Software Security, Protection, and Reverse Engineering / Software Security and Protection Workshop
Conference LocationNew York, NY, USA
ISBN Number978-1-4503-5387-8
Keywordsanomaly detection, composability, dynamic analysis, malware classification, malware detection, pubcrawl, Scalability, software assurance

Modern cyber attacks are often conducted by distributing digital documents that contain malware. The approach detailed herein, which consists of a classifier that uses features derived from dynamic analysis of a document viewer as it renders the document in question, is capable of classifying the disposition of digital documents with greater than 98% accuracy even when its model is trained on just small amounts of data. To keep the classification model itself small and thereby to provide scalability, we employ an entity resolution strategy that merges syntactically disparate features that are thought to be semantically equivalent but vary due to programmatic randomness. Entity resolution enables construction of a comprehensive model of benign functionality using relatively few training documents, and the model does not improve significantly with additional training data.

Citation Keyscofield_fast_2017