Fraunhofer-Gesellschaft

Publica

Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Does Every Second Count? Time-based Evolution of Malware Behavior in Sandboxes

 
: Küchler, Alexander; Mantovani, Alessandro; Han, Yufei; Bilge, Leyla; Balzarotti, Davide

:
Fulltext (PDF; )

Internet Society -ISOC-:
Network and Distributed Systems Security Symposium, NDSS 2021. Proceedings : 21-25 February 2021, Virtual
Reston, VA: Internet Society, 2021
ISBN: 1-891562-66-5
18 pp.
Network and Distributed Systems Security Symposium (NDSS) <2021, Online>
English
Conference Paper, Electronic Publication
Fraunhofer AISEC ()

Abstract
The amount of time in which a sample is executed is one of the key parameters of a malware analysis sandbox. Setting the threshold too high hinders the scalability and reduces the number of samples that can be analyzed in a day; too low and the samples may not have the time to show their malicious behavior, thus reducing the amount and quality of the collected data. Therefore, an analyst needs to find the ‘sweet spot’ that allows to collect only the minimum amount of information required to properly classify each sample. Anything more is wasting resources, anything less is jeopardizing the experiments.
Despite its importance, there are no clear guidelines on how to choose this parameter, nor experiments that can help companies to assess the pros and cons of a choice over another. To fill this gap, in this paper we provide the first large-scale study of the impact that the execution time has on both the amount and the quality of the collected events. We measure the evolution of system calls and code coverage, to draw a precise picture of the fraction of runtime behavior we can expect to observe in a sandbox. Finally, we implemented a machine learning based malware detection method, and applied it to the data collected in different time windows, to also report on the relevance of the events observed at different points in time.
Our results show that most samples run for either less than two minutes or for more than ten. However, most of the behavior (and 98% of the executed basic blocks) are observed during the first two minutes of execution, which is also the time windows that result in a higher accuracy of our ML classifier. We believe this information can help future researchers and industrial sandboxes to better tune their analysis systems.

: http://publica.fraunhofer.de/documents/N-636430.html