3. NLP-III

• signature based

• data driven

• reliable

• expensive to maintain -> keep signatures up to date

• no zero-day detection

• can be broken by small changes

• questionable reliability

• can detect zero-days and modified malware

• less expensive to maintain

• large, representative dataset

• interpretable model

• very low false-positives

• able to quickly react to defense by malware

• descriptive

• dense

• transferable between downstream tasks

• cheap to compute

• no semantics / count-based

• naive semantics

• stronger semantics

alternative:

• static vs dynamic

• structured vs unstructured

• static

  • -> same feature will always have same meaning (regardless of where it occurs…)

  • i.e. header fields…

• dynamic

  • change depending on context

  • i.e. system call sequence…

• structured:

  • i.e. header

• structureless:

  • no information on relation or order of stuff

  • -> i.e. entropy analysis

• conunt based:

  • no semantic, simply consider occurence…

• weak/naive semantic

  • i.e. BoW, tf-idf, n-gram

  • consider i.e. some co-occurences but no real semantic understanding

• stronger semantics

  • i.e. use count based or weak features

  • create embedding to introduce more semantic meaning

  • i.e. embedd whole control flow graph…

• divide CFG in code segments with no branches

  • code block that is always straigt executed…

• for each basic block create feature vector xi

• use e.g. count-based, optcode n-grams or tf-idf (we used optcode n-grams)

• embedding step

• Embedding of whole graph is sum over embedding of blocks

• embedding of blocks is found recursively using a NN

• the next iteration embedding is

• based on the initial feature vector and the sum of the neighboring embeddings

• the more we iterate, the more we take (further away) neighbors into consideration

• -> iteration count is the distance we take other blocks into consideration

• => T-hop neighborhood

• W is some matrix with dimensinality [embedding size x feature size]

• F is some non-linear NN

  • that takes as input the sum of the neighboring embeddings

  • has output dimensionality p

• => weighted base vector plus the output of the network on the sum of neighboring embeddings

• we have labeled dataset X,Y

• (gi, gj) yij == 1, if they were compiled from the same source but for different platforms and different compiler optimization levels

• -> thus network should indicate them to be the same…

• use siamese network and cosine similarity

• cossim of two graphs

• =

• cos(embedding of first, embedding of second)

• =

• dot product of two embeddings

• /

• sum of length of both embeddings || my || …

• basically minimize wrong classifications…

  
  

• have two identical network that share weights

• -> one uses the one graph embedding, the other the other graph embedding

• -> for training, compute cossim of both outputs

• for inference: we get two embeddings and then can use the embeddings to calcualte the similairty…