首页|Beyond the sandbox: Leveraging symbolic execution for evasive malware classification

Beyond the sandbox: Leveraging symbolic execution for evasive malware classification

扫码查看
原文链接
  • NETL
  • NSTL
Threat actors continuously update their code to incorporate counter-analysis techniques designed to evade detection and hinder the blocking of their malware。 The first line of defence for malware authors is often to bypass static analysis， a relatively straightforward task using readily available tools such as packers and cryptors。 To address this shortcoming， defenders send potential malware samples for execution in a sandbox environment。 While sandboxing can provide valuable insights into the behaviour of software on an information system， advanced techniques like anti-virtualisation and hooking evasion allow malware to escape detection。 The primary objective of this work is to complement sandbox execution with symbolic execution frameworks to detect new malware strains efficiently。 Symbolic execution offers a distinct advantage over sandboxing by achieving greater coverage of all possible execution traces， as it can explore every potential execution path， regardless of the evasion methods employed by the malware authors。 By carefully selecting the samples to be analysed， we can significantly reduce the workload while extracting essential dynamic features in a fraction of the time and with far fewer computational resources compared to sandboxing。 To this end， we leverage machine learning in an automated pipeline， enabling the accurate detection of sophisticated malware using a real-world dataset。 Our approach yields average F1 scores of 0。93 for the benign class and 0。99 for the malware class in a binary classification setup， surpassing the detection rates reported in the literature。 Additionally， our method outperforms a commercial malware sandbox when applied to the same dataset， further highlighting the efficacy of the proposed method。

MalwareSymbolic executionMachine learningMalware classificationClustering

Vasilis Vouvoutsis、Fran Casino、Constantinos Patsakis

展开 >

Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece

Department of Computer Engineering and Mathematics, Universitat Rovira i Virgili, Spain||Information Management Systems Institute, Athena Research Centre, Artemidos 6, Marousi 15125, Greece

Department of Informatics, University of Piraeus, 80 Karaoli & Dimitriou str., 18534 Piraeus, Greece||Information Management Systems Institute, Athena Research Centre, Artemidos 6, Marousi 15125, Greece

2025

10.1016/j.cose.2024.104193

Computers & security

Computers & security

SCI
ISSN：0167-4048
年,卷(期)：2025.149(Feb.)