AutoCombo: Automatic Malware Signature Generation Through Combination Rule Mining

This video recording is a presentation for our paper accepted in CIKM?21, named ?AutoCombo: Automatic Malware Signature Generation Through Combination Rule Mining''. In short, this paper proposes a systematic pipeline to automatically generate combination rule signatures for malware detection. Malware detection is an essential step in building trustworthy computer systems. Signature-based detection detects a sample as malware if the sample data match or contain a pre-stored malware signature. A combination rule signature could be viewed as a fixed set of properties, each of which describes some characteristic of an analyzed sample. This paper focuses on the generation of such signatures. Inspired by classic frequent itemsets mining solutions, the proposed AutoCombo approach is greedy but also complete. It generates higher quality signatures first, but is also able to traverse all possible property combinations for a complete generation. Further optimizations and future research potential are also discussed.