Services on Demand
Journal
Article
Indicators
- Cited by SciELO
- Access statistics
Related links
- Cited by Google
- Similars in SciELO
- Similars in Google
Share
Iteckne
Print version ISSN 1692-1798
Abstract
USECHE-PELAEZ, David Esteban; SEPULVEDA-ALZATE, Daniela; DIAZ-LOPEZ, Daniel Orlando and CABUYA-PADILLA, Diego Edison. BUILDING MALWARE CLASSIFICATORS USABLE BY STATE SECURITY AGENCIES. Iteckne [online]. 2018, vol.15, n.2, pp.107-121. ISSN 1692-1798. https://doi.org/10.15332/iteckne.v15i2.2072.
Sandboxing has been used regularly to analyze software samples and determine if these contain suspicious properties or behaviors. Even if sandboxing is a powerful technique to perform malware analysis, it requires that a malware analyst performs a rigorous analysis of the results to determine the nature of the sample: goodware or malware. This paper proposes two machine learning models able to classify samples based on signatures and permissions obtained through Cuckoo sandbox, Androguard and VirusTotal. The developed models are also tested obtaining an acceptable percentage of correctly classified samples, being in this way useful tools for a malware analyst. A proposal of architecture for an IoT sentinel that uses one of the developed machine learning model is also showed. Finally, different approaches, perspectives, and challenges about the use of sandboxing and machine learning by security teams in State security agencies are also shared.
Keywords : Cuckoo sandbox; data science; machine learning; malware analysis; sandboxing.