ModDiff: Modularity Similarity-Based Malware Homologation Detection

Huaqi Sun; Hui Shu; Fei Kang; Yan Guang

doi:10.3390/electronics12102258

journal article Open Access May 16, 2023

ModDiff: Modularity Similarity-Based Malware Homologation Detection

Huaqi Sun

Hui Shu

Fei Kang Yan Guang

Electronics Vol. 12 No. 10 pp. 2258 · MDPI AG

View at Publisher Save 10.3390/electronics12102258

Abstract

In recent years, the number and scale of malicious codes have grown exponentially, posing an increasing threat to cybersecurity. Hence, it is of great research value to quickly identify variants of malware and master their family information. Binary code similarity detection, as a key technique in reverse analysis, plays an indispensable role in malware analysis. However, most existing methods focus on similarity at the function or basic block level, ignoring the modular composition of malware. Implementing similarity detection among malware modules would greatly improve the efficiency and accuracy of homology detection. Inspired by the successful application of deep-learning techniques in program analysis, we propose a binary code module similarity detection method called ModDiff. It abstracts malware into attribute graphs, clusters functions using graph-embedded clustering algorithms to decompose malware into function-based modules, and calculates module similarity using graph-matching algorithms and natural language processing-based function similarity detection algorithms. The experimental results indicated that ModDiff improves the accuracy of module partitioning by 10.8% compared with previous work, and the highest F1 score of 89% is achieved in malware homologation detection. These results demonstrate the effectiveness of ModDiff in detecting and analyzing malware with important application value and development prospects.

Topics

No keywords indexed for this article. Browse by subject →

References

48

[1]

(2023, April 05). About Malware and Pua. Available online: https://portal.av-atlas.org/malware.

[2]

Almomani, I.M., Ahmed, M., and El-shafai, W. (2022). Android malware analysis in a nutshell. PLoS ONE, 17. 10.1371/journal.pone.0270647

[3]

El-shafai, W., Almomani, I.M., and Alkhayer, A. (2021). Visualized Malware Multi-Classification Framework Using Fine-Tuned CNN-Based Transfer Learning Models. Appl. Sci., 11. 10.3390/app11146446

[4]

Almomani "An Automated Vision-Based Deep Learning Model for Efficient Detection of Android Malware Attacks" IEEE Access (2022) 10.1109/access.2022.3140341

[5]

Haq "A Survey of Binary Code Similarity" ACM Comput. Surv. (2021) 10.1145/3446371

[6]

Duan, Y., Li, X., Wang, J., and Yin, H. (2020, January 23–26). DeepBinDiff: Learning Program-Wide Code Representations for Binary Diffing. Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA. 10.14722/ndss.2020.24311

[7]

Xue "Accurate and Scalable Cross-Architecture Cross-OS Binary Code Search with Emulation" IEEE Trans. Softw. Eng. (2019) 10.1109/tse.2018.2827379

[8]

Xu, Y., Xu, Z., Chen, B., Song, F., Liu, Y., and Liu, T. (2020, January 18–22). Patch based vulnerability matching for binary programs. Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing Analysis, Virtual Event, USA. 10.1145/3395363.3397361

[9]

Ding, S.H.H., Fung, B.C.M., and Charland, P. (2019, January 19–23). Asm2Vec: Boosting Static Representation Robustness for Binary Clone Search against Code Obfuscation and Compiler Optimization. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA. 10.1109/sp.2019.00003

[10]

Massarelli, L., Luna, G.A.D., Petroni, F., Querzoni, L., and Baldoni, R. (2018, January 28–29). SAFE: Self-Attentive Function Embeddings for Binary Similarity. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Saclay, France. 10.1007/978-3-030-22038-9_15

[11]

Li, X., Yu, Q., and Yin, H. (2021, January 15–19). PalmTree: Learning an Assembly Language Model for Instruction Embedding. Proceedings of the ACM SIGSAC Conference on Computer Communications Security, Virtual Event. 10.1145/3460120.3484587

[12]

Wang, H., Qu, W., Katz, G., Zhu, W., Gao, Z., Qiu, H., Zhuge, J., and Zhang, C. (2022, January 18–22). jTrans: Jump-aware transformer for binary code similarity detection. Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing Analysis, Seoul, Republic of Korea. 10.1145/3533767.3534367

[13]

Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., and Kallitsis, M. (2017, January 16–18). Understanding the Mirai Botnet. Proceedings of the USENIX Security Symposium, Vancouver, BC, Canada.

[14]

(2023, April 05). GAFGYT. Available online: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/GAFGYT/.

[15]

SIGNATURE VERIFICATION USING A “SIAMESE” TIME DELAY NEURAL NETWORK

JANE BROMLEY, JAMES W. BENTZ, Leon Bottou et al.

International Journal of Pattern Recognition and A... 1993 10.1142/s0218001493000339

[16]

Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. (2019). BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. arXiv.

[17]

Sarhan "Software Module Clustering: An In-Depth Literature Analysis" IEEE Trans. Softw. Eng. (2022) 10.1109/tse.2020.3042553

[18]

Xia, H., Zhang, Y., Chen, Y., Zhang, H., Wang, Z., and Wang, F. (2022, January 22–24). Software Module Clustering Using the Hierarchical Clustering Combination Method. Proceedings of the 7th International Conference on Cloud Computing and Big Data Analytics (ICCCBDA), Chengdu, China. 10.1109/icccbda55098.2022.9778877

[19]

Papachristou, M. (2019, January 26–30). Software clusterings with vector semantics and the call graph. Proceedings of the 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Tallinn, Estonia. 10.1145/3338906.3342483

[20]

Pan "Identifying key classes in object-oriented software using generalized k-core decomposition" Future Gener. Comput. Syst. (2018) 10.1016/j.future.2017.10.006

[21]

Karande, V., Chandra, S., Lin, Z., Caballero, J., Khan, L., and Hamlen, K. (2018, January 29). BCD: Decomposing Binary Code into Components Using Graph-Based Clustering. Proceedings of the Asia Conference on Computer and Communications Security, Incheon, Republic of Korea. 10.1145/3196494.3196504

[22]

Newman "Fast algorithm for detecting community structure in networks" Phys. Rev. E Stat. Nonlin. Soft Matter Phys. (2004) 10.1103/physreve.69.066133

[23]

Yang, C., Xu, Z., Chen, H., Liu, Y., Gong, X., and Liu, B. (2022, January 25–27). ModX: Binary Level Partially Imported Third-Party Library Detection via Program Modularization and Semantic Matching. Proceedings of the 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE), Pittsburgh, PA, USA. 10.1145/3510003.3510627

[24]

Fast unfolding of communities in large networks

Vincent D Blondel, Jean-Loup Guillaume, Renaud Lambiotte et al.

Journal of Statistical Mechanics: Theory and Exper... 2008 10.1088/1742-5468/2008/10/p10008

[25]

(2023, April 05). Hex-Rays. IDA FLIRT. Available online: https://hex-rays.com/products/ida/tech/flirt/.

[26]

Eschweiler, S., Yakdan, K., and Gerhards-Padilla, E. (2016, January 21–24). discovRE: Efficient Cross-Architecture Identification of Bugs in Binary Code. Proceedings of the Network and Distributed System Security Symposium (NDSS 2016), San Diego, CA, USA. 10.14722/ndss.2016.23185

[27]

Dullien "Graph-based comparison of Executable Objects" Sstic (2005)

[28]

Feng, Q., Zhou, R., Xu, C., Cheng, Y., Testa, B., and Yin, H. (2016, January 24–28). Scalable Graph-based Bug Search for Firmware Images. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria. 10.1145/2976749.2978370

[29]

Chandramohan, M., Xue, Y., Xu, Z., Liu, Y., Cho, C.Y., and Tan, H.B.K. (2016, January 13–18). BinGo: Cross-architecture cross-OS binary search. Proceedings of the 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering, Seattle, WA, USA. 10.1145/2950290.2950350

[30]

Wang, S., and Wu, D. (November, January 30). In-memory fuzzing for binary code similarity analysis. Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, Urbana, IL, USA.

[31]

Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., and Song, D.X. (November, January 30). Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection. Proceedings of the ACM SIGSAC Conference on Computer Communications Security, Dallas, TX, USA.

[32]

Gao, J., Yang, X., Fu, Y., Jiang, Y., and Sun, J. (2018, January 3–7). VulSeeker: A Semantic Learning Based Vulnerability Seeker for Cross-Platform Binary. Proceedings of the 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE), Montpellier, France. 10.1145/3238147.3240480

[33]

Le, Q.V., and Mikolov, T. (2014, January 21–26). Distributed Representations of Sentences and Documents. Proceedings of the International Conference on Machine Learning, Beijing, China.

[34]

Levine "Linkers and Loaders" Acm Comput. Surv. (1999)

[35]

Velickovic, P., Cucurull, G., Casanova, A., Romero, A., Lio’, P., and Bengio, Y. (2017). Graph Attention Networks. arXiv.

[36]

Xie, J., Girshick, R.B., and Farhadi, A. (2016). Unsupervised Deep Embedding for Clustering Analysis. arXiv.

[37]

Kingma, D.P., and Ba, J. (2014). Adam: A Method for Stochastic Optimization. arXiv.

[38]

Reimers, N., and Gurevych, I. (2019). Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. arXiv. 10.18653/v1/d19-1410

[39]

Gu, Y., Shu, H., and Hu, F. (2022). UniASM: Binary Code Similarity Detection without Fine-tuning. arXiv.

[40]

The Hungarian method for the assignment problem

H. W. Kuhn

Naval Research Logistics Quarterly 1955 10.1002/nav.3800020109

[41]

Rokon, M.O.F., Islam, R., Darki, A., Papalexakis, E.E., and Faloutsos, M. (2020, January 14–16). SourceFinder: Finding Malware Source-Code from Publicly Available Repositories in GitHub. Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020), San Sebastian, Spain.

[42]

(2023, April 05). MalwareBazaar. Available online: https://bazaar.abuse.ch/.

[43]

(2023, April 05). Zynamics BinDiff. Available online: https://www.zynamics.com/bindiff.html.

[44]

(2023, April 05). Diaphora-A Free and Open Source Program Diffing Tool. Available online: http://diaphora.re/.

[45]

Xu, X., Fan, M., Jia, A., Wang, Y., Yan, Z., Zheng, Q., and Liu, T. (2020, January 18–21). Revisiting the Challenges and Opportunities in Software Plagiarism Detection. Proceedings of the IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER), London, ON, Canada. 10.1109/saner48275.2020.9054847

[46]

Lin "Software Vulnerability Detection Using Deep Neural Networks: A Survey" Proc. IEEE (2020) 10.1109/jproc.2020.2993293

[47]

Huang "DeMal: Module decomposition of malware based on community discovery" Comput. Secur. (2022) 10.1016/j.cose.2022.102680

[48]

Yadegari, B., Johannesmeyer, B., Whitely, B., and Debray, S. (2015, January 17–21). A Generic Approach to Automatic Deobfuscation of Executable Code. Proceedings of the 2015 IEEE Symposium on Security and Privacy, San Jose, CA, USA. 10.1109/sp.2015.47

Metrics

6

Citations

48

References

Details

Published: May 16, 2023
Vol/Issue: 12(10)
Pages: 2258
License: View

Authors

H

Huaqi Sun

State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China

H

Hui Shu

State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China

F

Fei Kang

State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China

Y

Yan Guang

State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China

Cite This Article

Huaqi Sun, Hui Shu, Fei Kang, et al. (2023). ModDiff: Modularity Similarity-Based Malware Homologation Detection. Electronics, 12(10), 2258. https://doi.org/10.3390/electronics12102258

ModDiff: Modularity Similarity-Based Malware Homologation Detection

You May Also Like