Detecting malware with information complexity

Alshahwan, Nadia, Barr, Earl T., Clark, David, Danezis, George and Menéndez, Héctor D. ORCID logoORCID: (2020) Detecting malware with information complexity. Entropy, 22 (5) , 575. pp. 1-29. ISSN 1099-4300 [Article] (doi:10.3390/e22050575)

PDF - Published version (with publisher's formatting)
Available under License Creative Commons Attribution 4.0.

Download (1MB) | Preview


Malware concealment is the predominant strategy for malware propagation. Black hats create variants of malware based on polymorphism and metamorphism. Malware variants, by definition, share some information. Although the concealment strategy alters this information, there are still patterns on the software. Given a zoo of labelled malware and benign-ware, we ask whether a suspect program is more similar to our malware or to our benign-ware. Normalized Compression Distance (NCD) is a generic metric that measures the shared information content of two strings. This measure opens a new front in the malware arms race, one where the countermeasures promise to be more costly for malware writers, who must now obfuscate patterns as strings qua strings, without reference to execution, in their variants. Our approach classifies disk-resident malware with 97.4% accuracy and a false positive rate of 3%. We demonstrate that its accuracy can be improved by combining NCD with the compressibility rates of executables using decision forests, paving the way for future improvements. We demonstrate that malware reported within a narrow time frame of a few days is more homogeneous than malware reported over two years, but that our method still classifies the latter with 95.2% accuracy and a 5% false positive rate. Due to its use of compression, the time and computation cost of our method is nontrivial. We show that simple approximation techniques can improve its running time by up to 63%. We compare our results to the results of applying the 59 anti-malware programs used on the VirusTotal website to our malware. Our approach outperforms each one used alone and matches that of all of them used collectively.

Item Type: Article
Additional Information: This article belongs to the Section Multidisciplinary Applications
Keywords (uncontrolled): information theory, Kolmogorov complexity, normalized compression distance, malware detection
Research Areas: A. > School of Science and Technology > Computer Science
Item ID: 30236
Notes on copyright: © 2020 by the authors. Licensee MDPI, Basel, Switzerland. This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited
Useful Links:
Depositing User: Hector Menendez Benito
Date Deposited: 22 May 2020 15:59
Last Modified: 09 Feb 2022 10:37

Actions (login required)

View Item View Item


Activity Overview
6 month trend
6 month trend

Additional statistics are available via IRStats2.