Crimeware toolkit signature generation and detection using machine learning

Background: Nowadays, malware samples are automatically created by a custom crimeware toolkit that essentially creates a batch of functionally of the same malware in a different look using different obfuscation techniques and renders static signature-based detection. While there has been substantial research in automated malware classification, it remains challenging in the research community and the main role of crime ware toolkits in the explosion of crime ware has been ignored. Objective(s): Although such approaches have shown satisfactory performance on a large set of datasets, practical defense systems require precise detection during malware outbreaks where only a handful of samples created using a certain toolkit are available. The problem of toolkit signature generation and detection aims at detecting whether a binary file is created by a given toolkit or not. It has many security applications including signature generation and detection for crime ware toolkits, packers, and metamorphism engines. Methods: This paper presents a novel deep learning-based model for malware toolkit signature generation and detection. The method uses a deep belief network (DBN), implemented with a deep stack of denoising auto encoders trained by the fixed-target strategy for generating an effective toolkit signature that helps detect new malware samples generated using the same toolkit once a handful of malware samples are available. Results: The results show how powerful the toolkit signatures generated by the DBN allow for the accurate detection of new malware samples. Using a dataset containing a few training samples created by the same toolkit (Zeus), our method achieves up to 97% detection accuracy using 10 training samples and 1800 test samples, 0.002 sec average detection time (including sample preprocessing time), and 3.08 sec average model build time. Additionally, we introduce a novel concept of toolkit signature.