Authors:
Giovanni Ciaramella
1
;
2
;
Fabio Martinelli
3
;
Antonella Santone
4
and
Francesco Mercaldo
2
;
4
Affiliations:
1
IMT School for Advanced Studies Lucca, Lucca, Italy
;
2
Institute for Informatics and Telematics, National Research Council of Italy (CNR), Pisa, Italy
;
3
Institute for High Performance Computing and Networking, National Research Council of Italy (CNR), Rende, Italy
;
4
University of Molise, Campobasso, Italy
Keyword(s):
Malware, Packed Malware, Obfuscation, Deep Learning, Security, Testing.
Abstract:
The current signature-based mechanism implemented by free and commercial antimalware requires the presence of the signature of the malicious sample to provide protection, i.e., to detect malicious behavior. This is why malware writers are developing techniques that can change the syntax of the code but leave the semantics unchanged, i.e., the malware business logic. Among these techniques is the so-called packed malware, i.e., malware with binary code modified by packers, software aimed to pack software, compress it, and package it with a stub. It is a program capable of decompressing and executing it in memory. In this way, malware detected by antimalware is not even detected in the packed version. In this paper, we propose a technique to detect packed malware by exploiting convolutional neural networks. In a nutshell, the proposed method performs static analysis, i.e., it does not require running the application to detect the malicious samples: we start from the application’s binar
y code exploited to generate an image that represents the input for a set of deep learning classifiers. The classifiers aim to discern an application under analysis between trusted or (packed) malicious. In the experimental analysis, we consider three different packers (i.e., mpress, BEP, and gzexe) to generate packed malware, thus demonstrating the ability of the proposed method to detect packed and unpacked malware with interesting performances.
(More)