Building malware classificators usable by State security agencies

Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the na...

Full description

Autores:: Useche-Peláez, David Esteban
Díaz-López, Daniel Orlando
Sepúlveda-Alzate, Daniela
Cabuya-Padilla, Diego Edison

Tipo de recurso:

Fecha de publicación:: 2018

Institución:: Universidad Santo Tomás

Repositorio:: Universidad Santo Tomás

Idioma:: spa

Description
Summary:	Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the nature of the sample: goodware or malware. This paper proposes two machine learning models able to classify samples based on signatures and permissions obtained through Cuckoo sandbox, Androguard and VirusTotal. The developed models are also tested obtaining an acceptable percentage of correctly classified samples, being in this way useful tools for a malware analyst. A proposal of architecture for an IoT sentinel that uses one of the developed machine learning model is also showed. Finally, different approaches, perspectives, and challenges about the use of sandboxing and machine learning by security teams in State security agencies are also shared.

Building malware classificators usable by State security agencies

Publicaciones similares