紀要論文

実行ファイルの階層的構造に着目したマルウェア検知手法の検知能および判断根拠の検証

EVALUATION OF PERFORMANCE AND INTERPRETABILITY OF A MALWARE DETECTION METHOD FOCUSING ON A HIERARCHICAL STRUCTURE OF EXECUTABLE FILES

jpn

24368083

https://doi.org/10.15002/00026406

法政大学大学院理工学研究科

法政大学大学院紀要. 理工学研究科編

64

1

8

2023-03-24

Version of Record

ヘッダー部分に誤記 ; (誤) 法政大学大学院紀要理工学・工学研究科編 (正) 法政大学大学院紀要理工学研究科編

Machine learning-based malware detection methods realized fast, accurate, and flexible detection. However, their internal calculation processs tend to be black-boxed so they are unreliable and not used for commercial anti-malware softwares. Although some studies proposed interpretable malware detection methods to tackle to this problem, there still is a problem that there is no quantitative evaluation for the interpretability. In this study, we propose a novel method to evaluate the validity of the interpretability of a model by observing whether another malware detection method diagnoses a malware as a goodware after removing important components in it. Also, We propose a new interpretable malware detection method that utilizes a hierarchical structure in executable files: there are many functions in a file, and each function consists of assembly functions. Our model performs assembly instruction-level analysis, function-level analysis to analyze file using attention mechanism. By analyzing attention layers, our model can show which functions and instructions are suspicious. in this paper, We evaluated its performance and the validity of interpretability by experiments using applications of Android OS and Windows OS. As a result, we confirmed the model has high detection performance on both platforms, and the interpretability is verified on Windows applications.

Article