Building malware classificators usable by State security agencies
Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the na...
- Autores:
-
Useche-Peláez, David Esteban
Díaz-López, Daniel Orlando
Sepúlveda-Alzate, Daniela
Cabuya-Padilla, Diego Edison
- Tipo de recurso:
- Fecha de publicación:
- 2018
- Institución:
- Universidad Santo Tomás
- Repositorio:
- Repositorio Institucional USTA
- Idioma:
- spa
- OAI Identifier:
- oai:repository.usta.edu.co:11634/36191
- Acceso en línea:
- http://revistas.ustabuca.edu.co/index.php/ITECKNE/article/view/2072
http://hdl.handle.net/11634/36191
- Palabra clave:
- Rights
- License
- Copyright (c) 2018 ITECKNE
| Summary: | Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the nature of the sample: goodware or malware. This paper proposes two machine learning models able to classify samples based on signatures and permissions obtained through Cuckoo sandbox, Androguard and VirusTotal. The developed models are also tested obtaining an acceptable percentage of correctly classified samples, being in this way useful tools for a malware analyst. A proposal of architecture for an IoT sentinel that uses one of the developed machine learning model is also showed. Finally, different approaches, perspectives, and challenges about the use of sandboxing and machine learning by security teams in State security agencies are also shared. |
|---|