Building Malware Classificators usable by State Security Agencies

Translated title of the contribution: Construcción de clasificadores de malware para agencias de seguridad del Estado

David Useche-Peláez, Daniel Diaz-López, Daniela Sepúlveda-Alzate, Diego Cabuya-Padilla

Research output: Contribution to journalArticlepeer-review

Abstract

Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the nature of the sample: goodware or malware. This paper proposes two machine learning models able to classify samples based on signatures and permissions obtained through Cuckoo sandbox, Androguard and VirusTotal. The developed models are also tested obtaining an acceptable percentage of correctly classified samples, being in this way useful tools for a malware analyst. A proposal of architecture for an IoT sentinel that uses one of the developed machine learning model is also showed. Finally, different approaches, perspectives, and challenges about the use of sandboxing and machine learning by security teams in State security agencies are also shared.
Translated title of the contributionConstrucción de clasificadores de malware para agencias de seguridad del Estado
Original languageEnglish
Pages (from-to)107-121
Number of pages15
JournalITECKNE
Volume15
Issue number2
DOIs
StatePublished - Dec 1 2018
Externally publishedYes

Fingerprint Dive into the research topics of 'Construcción de clasificadores de malware para agencias de seguridad del Estado'. Together they form a unique fingerprint.

Cite this