LAB to SOC: Robust Features for Dynamic Malware Detection

Abstract

Machine learning models regularly achieve more than 95% accuracy in academic literature for dynamic malware detection problems, but the samples providing the data for these models are rarely shared publicly. This not only creates a benchmarking problem for academic and industry practitioners but could fail to reveal the hidden bias of machine learning models towards data from a particular source. This paper simulates "lab" experiments with several filetypes, machine learning algorithms, and features tested using data from two sources to probe the robustness of these models across different test sets. The first source is the same as the training data, the second is a commercial malware dataset provided by an organisation's advanced malware detection methods. These preliminary results indicate that for Windows executable files, widely used API call features are less robust than behavioural metrics such as CPU usage, RAM use, and packets received and transmitted, which give greater consistency in predictive accuracy rates across the different test sets.