提出哈姆-文字串算法，用更鲁棒的字节正则表达式提升恶意软件检测能力
Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes
- 用固定长度单字符通配符构造鲁棒的字节正则表达式
- 通过局部敏感哈希与聚类发现高频哈密顿距离相近的模式
- 适用于恶意软件分类与检测，对变异样本更具泛化能力
恶意软件构成持续演变的重大威胁，高效的检测与分类系统至关重要。当前常用静态特征中的n-gram存在固有脆弱性。本文提出一种名为hamm-grams的新算法，生成一类具有固定长度和单字符通配符的鲁棒正则表达式。设计了一种新型局部敏感哈希，可使小汉明距离的字节序列产生碰撞，并在哈希桶内聚类以确定通配符位置。实验表明，该特征在恶意软件分类与检测任务中表现优异，显著提升了对变种样本的识别能力。
原文摘要 · Abstract (English)
Malware poses a critical and ever-evolving threat, and robust and effective systems for detecting and classifying malware are of essential importance. $n$-grams features are among the common static features used in effective machine learning systems for malware, but these features are inherently brittle. We propose an algorithm for constructing more robust features, hamm-grams, which are a special class of regular expressions having a fixed length and single-character wildcards. We devise an efficient algorithm for finding common hamm-grams using a new locality-sensitive hash designed to produce collisions among pairs of small Hamming distance and a clustering within hash buckets to place wildcards. We then demonstrate the advantages of these features in malware classification and detection tasks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。