MALIGN: Explainable Static Raw-byte Based Malware Family Classification using Sequence Alignment

TL;DR

MAlign is a novel static malware classification method inspired by genome sequence alignment that not only classifies malware families with high accuracy but also provides interpretable explanations and robustness against attacks.

Contribution

It introduces a sequence alignment-based approach for static malware classification that generates interpretable signatures without human labor, outperforming existing methods especially on small datasets.

Findings

Outperforms state-of-the-art classifiers by up to 4.49% accuracy.

Achieves 19.48% improvement on small datasets.

Provides meaningful explanations for malware family signatures.

Abstract

For a long time, malware classification and analysis have been an arms-race between antivirus systems and malware authors. Though static analysis is vulnerable to evasion techniques, it is still popular as the first line of defense in antivirus systems. But most of the static analyzers failed to gain the trust of practitioners due to their black-box nature. We propose MAlign, a novel static malware family classification approach inspired by genome sequence alignment that can not only classify malware families but can also provide explanations for its decision. MAlign encodes raw bytes using nucleotides and adopts genome sequence alignment approaches to create a signature of a malware family based on the conserved code segments in that family, without any human labor or expertise. We evaluate MAlign on two malware datasets, and it outperforms other state-of-the-art machine learning based malware classifiers (by 4.49% - 0.07%), especially on small datasets (by 19.48% - 1.2%). Furthermore, we explain the generated signatures by MAlign on different malware families illustrating the kinds of insights it can provide to analysts, and show its efficacy as an analysis tool. Additionally, we evaluate its theoretical and empirical robustness against some common attacks. In this paper, we approach static malware analysis from a unique perspective, aiming to strike a delicate balance among performance, interpretability, and robustness.