kNN Classification of Malware Data Dependency Graph Features
I will be presenting this paper at the IEEE NAECON 2024 conference.
https://arxiv.org/abs/2406.02654
Abstract: “Explainability of classification results rests on the features used for classification. This study performs an accurate classification using features that are directly subject to further analysis, resolution increases, and explainable inferences. Data dependency graph features representative of data movement are directly correlated with operational semantics, and subject to fine grained analysis. In order to demonstrate the hypothesis that the features are tied to ground truth labels, an accurate classifier is trained using non-parametric learning. This was performed on a large scale canonical dataset, the Kaggle 2015 Malware dataset. Our study demonstrates that features representing data movement as operational semantics are correlated to ground truth labels. The features are subject to further fine grained analysis for explainable inferences. This allows for the body of the term frequency distribution to be further analyzed. This provides an increase in feature resolution over term frequency features. This method obtains high accuracy from analysis of a single instruction, a method that can be repeated for additional instructions to obtain further increases in accuracy. This study demonstrates the hypothesis that the semantic representation and analysis of structure are able to make accurate predications and are correlated to ground truth labels. Additionally, similarity in the metric space can be calculated directly without prior training. Our results provide evidence that data dependency graphs accurately capture both semantic and structural information for increased explainability in classification results.”
@misc{musgrave2024knn,
title={kNN Classification of Malware Data Dependency Graph Features},
author={John Musgrave and Anca Ralescu},
year={2024},
eprint={2406.02654},
archivePrefix={arXiv},
primaryClass={cs.CR}
}