N-grams-based file signatures for malware detection

N-GRAMS-BASED FILE SIGNATURES FOR MALWARE DETECTION Igor Santos, Yoseba K. Penya, Jaime Devesa and Pablo G. Bringas S3Lab, Deusto Technological Foundation, Bilbao, Spain Keywords: Security, Computer viruses, Data-mining, Malware detection, Machine learning. Abstract: Malware is any malicious code that has the potential to harm any computer or network. The amount of malware is increasing faster every year and poses a serious security threat. Thus, malware detection is a critical topic in computer security. Currently, signature-based detection is the most extended method for detecting malware. Although this method is still used on most popular commercial computer antivirus software, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new malware. Applying a methodology proven successful in similar problem-domains, we propose the use of ngrams (every substring of a larger string, of a fixed lenght n) as file signatures in order to detect unknown malware whilst keeping low false positive ratio. We show that n-grams signatures provide an effective way to detect unknown malware. 1 INTRODUCTION The term malware was coined to name any computer program with malicious intentions, such as viruses, worms, or Trojan horses. As one may think, parallel to the grow of the Internet, the amount, power, and variety of malware increases every year (Kaspersky, 2008), as well as its ability to avoid all kind of security barriers. The classic method to detect these threats consists on waiting for a certain number of computers to be infected, determining then a file signature for the virus and finally finding a specific solution for it. In this way, based on the list of signatures (also known as signature database (Morley, 2001)), the malware detection software can provide protection against known viruses (ie. those on the list). This approach has proved to be effective when the threats are known in beforehand, and is the most extended solution within antivirus software. Still, as already mentioned, it fails when facing new ones. Moreover, upon new virus apparition and until the corresponding file signature is obtained, mutations of the original virus released in the meanwhile may escape to detection based on that signature. These facts have led to a situation in which malware writers develop new viruses and different ways for hiding their code, while researchers design new tools and strategies to detect them (Nachenberg, 1997). Such evolution makes very difficult to develop an universal malware detector. Thus, the task of the researcher is to achieve very good results against known malware and to turn the attempt of writing new undetectable virus more difficult. Generally, there are several indicators to evaluate the effectiveness of a new malware detection system. First, we have to look at its malware detection ratio (i.e. the amount of viruses of a sample that the software detects). Second, we have to look at the false positive ratio (i.e. the amount of non malicious programs that are erroneously classified as malware), since it determines how practical the method is to be commercialised: a new system able to detect a lot of malware but at the cost of a high rate of false positives is not practical in the real world, where the system must deal with a lot of benign software that should not be classified as malware. Therefore, antivirus companies usually prefer a modest detection ratio with low (or ideally zero) false positive ratio rather than a notable detection one with high also a false positive ratio. Language recognition is a research area that has tackled a similar problem, since they also have to deal with the retrieval of information that is hard to see at the first glance. The most extended technique against this problem has been the use of the so-called 317 Santos I., Penya Y., Devesa J. and Bringas P. (2009). N-GRAMS-BASED FILE SIGNATURES FOR MALWARE DETECTION. In Proceedings of the 11th International Conference on Enterprise Information Systems - Articial Intelligence and Decision Support Systems, pages 317-320 DOI: 10.5220/0001863603170320 Copyright c ©SciTePress