Detecting and Classifying Self-Deleting Windows Malware Using Prefetch Files
No Thumbnail Available
Authors
Duby, Adam
Taylor, Teryl
Bloom, Gedare
Zhuang, Yanyan
Issue Date
2022-01-26
Type
proceedings-article
Language
Keywords
Prefetching , Forensics , Conferences , Semantics , Machine Learning , Feature extraction , Malware
Alternative Title
Abstract
Malware detection and analysis can be a burdensome task for incident responders. As such, research has turned to machine learning to automate malware detection and malware family classification. Existing work extracts and engineers static and dynamic features from the malware sample to train classifiers. Despite promising results, such techniques assume that the analyst has access to the malware executable file. Self-deleting malware invalidates this assumption and requires analysts to find forensic evidence of malware execution for further analysis. In this paper, we present and evaluate an approach to detecting malware that executed on a Windows target and further classify the malware into its associated family to provide semantic insight. Specifically, we engineer features from the Windows prefetch file, a file system forensic artifact that archives process information. Results show that it is possible to detect the malicious artifact with 99% accuracy; furthermore, classifying the malware into a fine-grained family has comparable performance to techniques that require access to the original executable. We also provide a thorough security discussion of the proposed approach against adversarial diversity.
Description
Citation
A. Duby, T. Taylor, G. Bloom and Y. Zhuang, "Detecting and Classifying Self-Deleting Windows Malware Using Prefetch Files," 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 2022, pp. 0745-0751, doi: 10.1109/CCWC54503.2022.9720874.
Publisher
IEEE