In this work, a so-called “Time Evolution Model” is suggested to help categorize files of a sample set used in antivirus testing procedures. The basic time-dependent variable of this model is the Ratio of the Infected files within an investigated Time Window. To estimate the main characteristics of the time series describing the change of the Ratio values related to a specific file, a nonlinear, exponential curve fitting method is used. The free parameters of the model were determined by numerical searching algorithms. The effectiveness and the reliability of the model is also demonstrated by several real-word and numerically simulated examples.
As business and people rely more and more on computer related devices (including
smart devices and the IoT), they are increasingly vulnerable to cyber-attacks [
Security solution testers use malicious files (sample set) coming from diferent
sources to determine whether the defense is able to detect these files as malicious
or not [
One of the most important parts of the testing procedure influencing the reliability of the procedure is the correct and relevant selection of the used sample set.
How to correctly classify samples of a sample set is one the major issues for
security solution testers to ensure their service to be reliable and to be able to
give relevant recommendations for their client about the capabilities of security
solutions [
Besides the main question whether a given object (file/URL) (abbreviated only
ifle in what follows) in a sample set is “ Infected ” or “ Noninfected ” [
Sample selection can be broken down into three phases [
The sample validation process essentially is series of tests to make sure that the sample is functional (has working malicious function). There are several methods trying to validate samples: reverse engineering, usage of automated tools or by using various specialized tools (e.g. sandboxes) to check file integrity or functionality.
Best practices show that validation is most valuable when it is based on sample functionality, but these methods are not applicable to all sample types and may need enormous eforts to pursue these kinds of activities on a daily basis with huge number of files.
In this paper a so-called “ Time Evolution Model ” is suggested to help categorize each file or even a whole sample set (also called as feed).
The basic time-dependent variable of this model is the Ratio of the “ Yes” decisions to the question: Is this file infected? The answers come from the members of a set of antimalware where most of these members showed reliable operations in the past in malware detection.
After the appearance of a new malware it takes less or more time for the diferent antimalware to detect the fact of infection. Some antimalware is simply not able to recognize some specific infections. (Possibly due to some validation issue.) Hence the ratio of “ Yes” decisions is gradually increasing in time and reaches the state when the increase and the variation of the Ratio value is small enough to establish this Ratio as the steady state value of the time evolution.
The main goal of this study is to establish the main characteristics of these time functions. A nonlinear curve fitting method is used to fit a smooth time function on the observed Ratio data to estimate the steady state value (called Asymptote), the Start Time (starting time of operation) and the Slope at the Start Time for each file in a feed. These parameters can be used later to classify a file belonging to a certain category (“ Old ”, “ New ”, “ Infected ”, “ Noninfected ”, etc.).
For this estimation past Ratio data within a Time Window are used. The Time Window ends at the moment of investigation (“Today”) and goes back in time. Obviously, the length of time, how far the Time Window goes back, has influence on the estimation. It is also investigated.
The reliability of the “Yes” decisions of the antiviruses is crucial. In this study it is assumed that the antimalware set consists of properly selected members. The process of selection resulting in a reliable set is discussed elsewhere.
As an example, in Table 1 the results of classifications for a sample of files are summarized. . . .
AV 100
Yes No #AV 97 93 #Yes 34 43 Yes Yes No Yes No No Yes
The cells of the table show the / results of classifications for = 1000 diferent files by = 100 antiviruses for 17 days. Typically, not all files are checked by all on all days, so some cells contain no data. In the Ratio column the ratio of the number of -es (# ) and the number of nonempty cells (# ) in the given row is calculated.
The time evolution of the Ratio variables is better representable by time series graphs. In Figure 1 typical graphs for diferent files are shown where the diferent ifles are in diferent phases of antimalware detection. In Figure 2 those files are selected which can be considered as “ Old ” infected files.
Here the values of the Ratio variable show little fluctuation around diferent “imaginary”, almost horizontal lines for the diferent files. This steady state feature forecasts not much change in the future, so these steady state Ratio values can be the basis for classifying the diferent files. Depending on the purpose of classification diferent threshold values can be decided in advance to categorize the ifles. If only two categories are used, above some predefined value (e.g. = 0.7) a file can be taken as an “ Infected ” file, otherwise as “ Noninfected ”. Sometimes three categories are better to use: “ Infected ”, “ Noninfected ”, “ Gray ”. In this case two threshold values and (e.g. = 0.7 and = 0.4) can divide the zero-one interval into three diferent classification categories. The details for establishing these threshold values are not discussed here.
In Figure 3 and in Figure 4 the situations are diferent. Both figures suggest that the gradual increases of the Ratio values have not been finished, the infections are “ New ”, they have been detected recently. These forecast additional increases in Ratio values, so the steady state Ratio values are in questions. In Figure 3 the graphs suggest the Start Time-s of the infection outside the Time Window while the graphs in Figure 4 suggest them inside.
To estimate the main characteristics of the time series describing the change of the Ratio values related to a specific file, nonlinear curve fitting method is used. For each file a theoretical time function is fitted to the observed Ratio values. In Figure 5 the notations are summarized.
Malware Detection in Time ) s b o y ,( y o i t a R
Age
In what follows ( ) or simply
denotes the observed Ratio values in time. (Sometimes the more precise
( ) is used since the observations are in discrete
time instants.) The function ( ) or simply is the fitted function to be determined
as the best fitted function to the observed
values. Hence
( ) = ( ) + ( )
(3.1)
where ( ) is a random error term. The function ( ) is searched in an exponential
form widely used in diferent growth models [
Unlike linear curve fitting, it is not possible to find analytical solution for the least squares, instead numerical search procedures must be used. In the examples presented here Matlab https://www.mathworks.com/products/matlab.html software’s built in optimization procedures have been used.
In the optimization the constrains
1 ≤ 1 and 2 ≥ 0 category.
The the beginning. were applied.
It is worth seeing that concrete “physical” meaning can be attributed to the three free parameters in the model. The 1 value corresponds to the Asymptote shown in Figure 5 Depending on the 1 value, a specific file can directly be classified in to the “ Infected ” or “ Noninfected ” category.
The parameter 3 is the Start Time when the infection begins. Depending on the 3 value, a specific file can directly be classified in to the “ Old ” or “ New ” = 1 2 product gives the tangent of the angle at Start Time. This Slope value may refer to the extent (the speed) of spread of a specific infection at
Several samples, several real-world files’ time evolution models have been set up in the present study. In Figure 6 some of them are presented where the final results of the numerical search procedures for the 1, 2, 3 parameters are also shown.
In all cases the present time (T“oday”) is denoted as = 27. The Time Window goes back to = 1 and the time scale goes beyond and to get some impression about the possible run of the curves in the past and in the future. The diferent panels of the figure depict diferent detection situations. In Figure 6b and in Figure 6d the graphs show more or less steady state situations where Figure 6d reveals a “ Noninfected ” case when the detection started long time before while the 1 = 0.428 value in Figure 6b refers to a rather uncertain case, probably better to classify it as a “ Gray ” situation.
In both, in Figure 6a and in Figure 6c the curves suggest further increases of values in time in “ Infected ” situations. However, the observed values in Figure 6c suggest less uncertainty in the estimated 1 = 0.682 Asymptote and in the 3 = −3.018 Start Time values while the prediction for the 1 = 0.813 and the 3 = −32.15 values in Figure 6a are probably more uncertain.
It is obvious that the extent of uncertainty in the predicted 1, 2 and 3 parameters is dependent on the run of the observed values. More precisely they are influenced by the Δ( ) width, the location of the Time Window (relative to the Time Start), and the spread of the values (this can be characterized by the ( ) standard deviation in the model equation (3.1)).
It needs further studies to establish confidence intervals for the 1, 2 and 3 parameters. In this nonlinear curve fitting it is hopeless to get closed form analytical solutions for these intervals but numerical simulation studies covering the whole space of the influencing factors may help in determining them.
In practice the question arises in the form: What is the minimal size of the Time Window at a given file to get reliable estimates for the parameters?
To get some impression about the efects of the influencing factors, in Figure 7, for two diferent files where the width of the
Time Window is gradually widened.
tfirst = 26 time to the malware’s start of operation good fit can be seen within the whole Time Window. Hence the Start Time = 3 = 9.922 and the = 1 2 = 0.734 · 0.085 = 0.062 values can be regarded as good estimates. The value of Asymptote = 1 = 0.731 holds more uncertainty, however, this Δ( ) = 20 wide Time Window seems to be wide enough to produce a reliable Asymptote value to classify the file as being “ Infected ”.
In Figure 7a-c the fluctuations of the parameter values can be seen as the value approaches to the Time Start value.
tfirst = 24 tfirst = 7
tlast = 30
In Figure 8 and in Figure 9 not a real world but a numerically simulated curve is used to illustrate the situation when the Start Time is outside the available widest Time Window, so no chance to trace the parameter values back to the Start Time value.
In Figure 9a the layout of the situation is summarized. The widest Time Window is Δ( ) = 30 − 1 = 29 wide and within this window the values have been randomly simulated using the = 0.9 −0.1( +10) deterministic function and the normally distributed random errors with zero mean and ( ) = 0.015 standard deviation.
In Figure 9 the , curves and the numerically searched parameter values are shown in case of four diferent Time Windows. It is worth seeing how far the three numerically searched parameters are from the deterministic 1 = 0.9, 2 = 0.1 ( = 0.9 · 0.1 = 0.09), 3 = −10 values.
In Figure 9 the change of the parameters is shown as the width of the Time Window is gradually changing. It is worth following the tendencies of the change backwards along the axis. In Figure 9c and in Figure 9d as the value is decreasing from the = 30 value (as the width of the Time Window is increasing) the estimated Slope and 3 (Start Time) values are convincingly converging to their deterministic values. After some fluctuation when the width of the Time Window reaches the Δ( ) = 10 values the fluctuation becomes almost negligible. In Figure 9b the situation is even better. The estimated 1 parameter value (the Asymptote) is very close to the deterministic 1 = 0.9 value even in the very narrow Time Window cases. All these 1 values would classify the given file as being “ Infected ”.
In this paper a so called “Time Evolution Model” was suggested to help categorize ifles of a sample set in antimalware testing procedures. The basic time dependent variable of this model is the Ratio of the Infected files within an investigated Time Window. To estimate the main characteristics of the time series describing the change of the Ratio values related to a specific file, nonlinear, exponential curve iftting method was used. The free parameters of the model were determined by numerical searching algorithms, hence specific “physical” characteristics of the sample set were calculated.
The efectiveness and the reliability of the model was demonstrated by several real-word and numerically simulated examples.
Further studies are required to establish the extent of reliability of the model in the whole parameter space and to give general recommendations for the minimal size of the Time Window for reliable classifications. [1] S. Brown, J. Gommers, O. Serrano: From Cyber Security Information Sharing to Threat Management, in: Proceedings of the 2nd ACM Workshop on Information Sharing and Collab[17] H. Yin, D. Song, M. Egele, C. Kruegel, E. Kirda: Panorama: Capturing system-wide information flow for malware detection and analysis , in: Jan. 2007, pp. 116–127, doi: 10.1145/1315245.1315261.