论文标题
使用折衷行为指标的沙盒样品分类
Sandbox Sample Classification Using Behavioral Indicators of Compromise
论文作者
论文摘要
妥协的行为指标与通过观察虚拟执行环境中执行的系统功能调用来提取样本行为的各种自动化方法相关联。因此，每个样本都是由一组由样本行为在沙盒环境中触发的BIC的描述。在这里，我们根据触发的BIC列表讨论了一种机器学习方法，将沙盒样本分类为恶意或良性。除了更传统的方法（例如逻辑回归和天真的贝叶斯分类），我们还讨论了一种受统计蒙特卡洛方法启发的不同方法。使用thrant Grid和reversingLabs数据来说明数值结果。
Behavioral Indicators of Compromise are associated with various automated methods used to extract the sample behavior by observing the system function calls performed in a virtual execution environment. Thus, every sample is described by a set of BICs triggered by the sample behavior in the sandbox environment. Here we discuss a Machine Learning approach to the classification of the sandbox samples as MALICIOUS or BENIGN, based on the list of triggered BICs. Besides the more traditional methods like Logistic Regression and Naive Bayes Classification we also discuss a different approach inspired by the statistical Monte Carlo methods. The numerical results are illustrated using ThreatGRID and ReversingLabs data.
