Predicting Malware Attributes from Cybersecurity Texts

Proceedings of NAACL-HLT 2019, pages 2857–2861 Minneapolis, Minnesota, June 2 - June 7, 2019. c⃝2019 Association for Computational Linguistics 2857 Predicting Malware Attributes from Cybersecurity Texts Arpita Roy1, Youngja Park2, Shimei Pan1 1University of Maryland, Baltimore County Baltimore, Maryland, USA {arpita2, shimei}@umbc.edu 2IBM T. J. Watson Research Center Yorktown Heights, New York, USA young park@us.ibm.com Abstract Text analytics is a useful tool for studying mal- ware behavior and tracking emerging threats. The task of automated malware attribute iden- tification based on cybersecurity texts is very challenging due to a large number of malware attribute labels and a small number of training instances. In this paper, we propose a novel feature learning method to leverage diverse knowledge sources such as small amount of human annotations, unlabeled text and speci- fications about malware attribute labels. Our evaluation has demonstrated the effectiveness of our method over the state-of-the-art mal- ware attribute prediction systems. 1 Introduction Securing computer systems has become a neces- sity for both organizations and individuals, as many cyber attacks result in devastating conse- quences. An outbreak of the WannaCry ran- somware in 2017 affected more than 200,000 com- puters across 150 countries, with total damages ranging from hundreds of millions to billions of dollars (Berr, 2017). Detection of malware often relies on an understanding of the characteristics of malware behavior. To establish a standard for unambiguously characterizing malware, MAEC (Malware Attribute Enumeration and Characteri- zation), a community-based project organized by MITRE, has specified a set of standard malware attributes (Kirillov et al., 2011). Based on MAEC, the actions of a malware can be categorized by four attributes: ActionName, Capability, Strategi- cObjectives and TacticalObjectives. ActionName specifies the actions taken by a malware. For example, “delete file” is a malware action that deletes existing files from affected systems. Capa- bility defines the general capabilities of a malware. For example, “anti-removal” is a malware capabil- ity that prevents itself from being removed from a system. StrategicObjectives and TacticalObjec- tives are subcategories of Capability to capture more details. For example, a malware can have a StrategicObjective of “staging data for exfiltra- tion” and a TacticalObjective of “moving data to a staging server”. In total, MAEC specified 211 ActionNames, 20 Capabilities, 65 StrategicObjec- tives, and 148 TacticalObjectives. The goal of this research is to automatically as- sign malware attribute labels based on cybersecu- rity texts. The task is challenging. The system needs to assign a large number of labels (444 in total). However, it is difficult to obtain sufficient training examples for each label since malware attribute labeling requires extensive cybersecurity knowledge and only domain experts can do this re- liably. Given a large number of possible labels and a small number of training examples, typical su- pervised text classification techniques do not work well. In this work, we focus on incorporating addi- tional knowledge sources to improve feature learn- ing. The main contributions of this work include 1. Develop a novel malware attribute predic- tion system with the state of the art perfor- mance …

Content truncated to 500 words