Behavior based malware detection using probabilistic programming technique

Abstract

Malware has evolved steadily in many different types and also shown an exponential increase in the number. In an effort to protect the users against malware, malware detection technologies have been proposed, which are based on ML (machine learning). These technologies are of help in detecting malicious behaviors of malware without human experts’ intervention. However, legacy ML-based malware detection techniques require a pre-training process to model a malware family, which causes the scalability problem. In this work, we propose a new malware detection framework based on Probabilistic Programming. In this framework, the behaviors of malware process are described as a set of simple first-order logic, and security experts can detect malicious behaviors by writing a simple rule. To show the feasibility of the proposed framework, we employ a family of ransomware as a use case. To this end, we collect malware samples and provide a set of Probabilistic Programming rules to describe the detection process of the samples.