{'fraction_non_alphanumeric': 0.00962962962962963, 'fraction_numerical': 0.0044444444444444444, 'mean_word_length': 5.721393034825871, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Generalizing Behavioral Signatures for Detecting Unknown Malware Variants and Early Warning

Malware poses a major threat on the Internet today. Polymorphic obfuscation techniques employed by malware render static malware analysis and detection approaches based on static signatures ineffective. We present our malware early warning system that is based on dynamic behavioral analysis and aims at deriving generalizing behavioral detection signatures for malware. In the context of early warning a particularly desired property of the generated signatures is not only to detect the malware binaries which are known during signature generation, but also to detect unknown (polymorphic) variants of these known binaries. We present a tentative experimental study on the generalization of behavioral signatures and investigate the question, which share of a polymorphic malware family is required to be known for generating a signature showing an acceptable detection performance for the whole family? Experimental results showed that for 90% of the considered malware families less than 14 family members are required to generate a behavioral signature that detects at least 80% of the whole family. The results are quite promising and encourage further investigation of our approach for automatic generation of behavioral malware detection signatures.