CAS: A framework of online detecting advance malware families for cloud-based security

Abstract

Preventing networks from being attacked has become a critical issue for network administrators and researchers. With the popularity and variety of large-scale zero-day threats over the Internet, security companies have to keep on inserting new virus signatures into their databases. However, the increasing size of virus signature file is dragging computers to a crawl during the virus scan. To effectively handle the scale and magnitude of new malware variants, antivirus functionality is being moved from the user desktop into the cloud. The large-scale volume of advanced malware has created a need for automatic framework which can discover inter-family correlations for online detection. In this paper, we propose a fast and efficient technique to extract correlation signatures from advanced malware families for cloud-based security systems. At the core of our work is CAS, a framework for large-scale and cross-family malware analysis. CAS uses novel method for Advanced Persistent Threats (APTs) correlation. Our large-scale testing shows that CAS can detect millions of malware samples efficiently with malware correlation signatures at inline speed. These advanced malware include packers, PE malware, mobile malware, scripts and non-PE malware.