[论文解读] Ransomware Analysis using Feature Engineering and Deep Neural Networks

Arslan Ashraf, Abdul Aziz+3 more|arXiv (Cornell University)|Oct 1, 2019

Advanced Malware Detection Techniques参考文献 23被引用 17

一句话总结

本文提出了一种结合特征工程与深度学习的勒索软件检测框架，利用静态和动态数据集识别关键行为模式——特别是注册表删除、API调用和DLL使用。结果表明，勒索软件在注册表操作中表现出独特且可重复的序列，与良性软件不同，从而可通过传统机器学习和基于迁移学习的卷积神经网络（CNN）实现高精度检测，动态数据集上的F1得分超过0.95。

ABSTRACT

Detection and analysis of a potential malware specifically, used for ransom is a challenging task. Recently, intruders are utilizing advanced cryptographic techniques to get hold of digital assets and then demand a ransom. It is believed that generally, the files comprise of some attributes, states, and patterns that can be recognized by a machine learning technique. This work thus focuses on the detection of Ransomware by performing feature engineering, which helps in analyzing vital attributes and behaviors of the malware. The main contribution of this work is the identification of important and distinct characteristics of Ransomware that can help in detecting them. Finally, based on the selected features, both conventional machine learning techniques and Transfer Learning based Deep Convolutional Neural Networks have been used to detect Ransomware. In order to perform feature engineering and analysis, two separate datasets (static and dynamic) were generated. The static dataset has 3646 samples (1700 Ransomware and 1946 Goodware). On the other hand, the dynamic dataset comprised of 3444 samples (1455 Ransomware and 1989 Goodware). Through various experiments, it is observed that the Registry changes, API calls, and DLLs are the most important features for Ransomware detection. Additionally, important sequences are found with the help of the N-Gram technique. It is also observed that in the case of Registry Delete operation, if a malicious file tries to delete registries, it follows a specific and repeated sequence. However, for the benign file, it doesnt follow any specific sequence or repetition. Similarly, an interesting observation made through this study is that there is no common Registry deleted sequence between malicious and benign files. And thus this discernible fact can be readily exploited for Ransomware detection.

研究动机与目标

• 识别勒索软件的区分性行为与结构特征，以提升检测能力。
• 解决利用加密技术逃避传统基于签名方法的高级勒索软件检测挑战。
• 开发一种结合特征工程与深度学习的混合检测方法，以提升检测精度。
• 生成并利用双数据集（静态和动态）以捕捉多样化的勒索软件行为。

提出的方法

• 对3646个静态样本和3444个动态样本应用了特征工程，包括API调用、注册表更改和DLL使用。
• 采用n-gram分析检测系统调用中的序列模式，尤其关注注册表删除操作。
• 采用基于深度卷积神经网络（CNN）的迁移学习方法，基于工程化特征对勒索软件进行分类。
• 在生成的数据集上对传统机器学习模型和预训练CNN进行了性能对比评估。
• 研究重点在于识别注册表操作中的重复性和独特序列，作为恶意行为的区分性指标。
• 使用标准指标（包括F1得分、精确率和召回率）在静态和动态数据集上进行评估。

实验结果

研究问题

• RQ1 哪些系统级特征（如API调用、注册表更改、DLL）最能指示勒索软件行为？
• RQ2 系统操作中的序列模式——尤其是注册表删除——能否有效区分勒索软件与良性软件？
• RQ3 在结合工程化特征的前提下，基于深度CNN的迁移学习在勒索软件检测中的有效性如何？
• RQ4 恶意文件与良性文件在注册表删除序列中是否表现出不同的模式？
• RQ5 与基线方法相比，特征工程能否显著提升检测精度？

主要发现

• 勒索软件中的注册表删除操作遵循特定且可重复的序列，而良性文件则无一致或重复的模式。
• 在恶意文件与良性文件之间未观察到共同的注册表删除序列，表明该行为是强有力的区分性信号。
• API调用、注册表更改和DLL使用被确定为勒索软件检测中最关键的特征。
• 深度学习模型在动态数据集上的F1得分超过0.95，表明检测精度极高。
• n-gram分析成功捕捉了关键行为序列，尤其在恶意注册表操作中表现突出。
• 特征工程与基于迁移学习的CNN结合方法在检测性能上优于传统机器学习模型。