Jordaney, R; Sharad, K; Dash, SK; Wang, Z; Papini, D; Nouretdinov, I; Cavallaro, L; (2017) Transcend: Detecting Concept Drift in Malware Classification Models. In: Proceedings of the 26th USENIX Security Symposium. (pp. pp. 625-642). USENIX Association: Vancouver, Canada.

Preview

Text sec17-jordaney.pdf - Published Version Download (1MB) | Preview

Abstract

Building machine learning models of malware behavior is widely accepted as a panacea towards effective malware classification. A crucial requirement for building sustainable learning models, though, is to train on a wide variety of malware samples. Unfortunately, malware evolves rapidly and it thus becomes hard—if not impossible—to generalize learning models to reflect future, previously-unseen behaviors. Consequently, most malware classifiers become unsustainable in the long run, becoming rapidly antiquated as malware continues to evolve. In this work, we propose Transcend, a framework to identify aging classification models in vivo during deployment, much before the machine learning model’s performance starts to degrade. This is a significant departure from conventional approaches that retrain aging models retrospectively when poor performance is observed. Our approach uses a statistical comparison of samples seen during deployment with those used to train the model, thereby building metrics for prediction quality. We show how Transcend can be used to identify concept drift based on two separate case studies on Android andWindows malware, raising a red flag before the model starts making consistently poor decisions due to out-of-date training.

Downloads since deposit

Loading...

42Downloads

Download activity - last month

Export as XMLCSVJSON

Loading...

Download activity - last 12 months

Export as XMLCSVJSON

Loading...

Downloads by country - last 12 months

Export as CSVXMLJSON

Loading...

Archive Staff Only

View Item