论文标题
AVCLASS2：从AV标签中提取大量恶意软件标签
AVClass2: Massive Malware Tag Extraction from AV Labels
论文作者
论文摘要
标签可以由恶意软件存储库和分析服务使用，以启用跨不同维度感兴趣的样本的搜索。自动从AV标签中提取标签是一种有效的方法，可以对大量样品进行分类和索引。诸如Avclass和Euphony之类的最近工具表明，尽管具有嘈杂的性质，但仍可以从AV标签中提取姓氏。但是，除了姓氏之外，AV标签还包含许多有价值的信息，例如恶意软件类，文件属性和行为。 这项工作介绍了AVClass2是一种自动恶意软件标记工具，该工具给出了可能大量样本的AV标签，它提取了将样品分类的干净标签。 AVClass2使用并帮助构建，这是一种在AV标签中组织概念的开放分类法，但不受预定义的标签的约束。为了使自己更新随着AV供应商引入新标签的更新，它提供了一个更新模块，该模块自动识别新的分类学条目，以及捕获标签之间关系的标记和扩展规则。我们已经评估了42m的AVCLASS2，并展示了它如何启用高级恶意软件搜索并维护AV标签中恶意软件概念的更新知识库。
Tags can be used by malware repositories and analysis services to enable searches for samples of interest across different dimensions. Automatically extracting tags from AV labels is an efficient approach to categorize and index massive amounts of samples. Recent tools like AVClass and Euphony have demonstrated that, despite their noisy nature, it is possible to extract family names from AV labels. However, beyond the family name, AV labels contain much valuable information such as malware classes, file properties, and behaviors. This work presents AVClass2, an automatic malware tagging tool that given the AV labels for a potentially massive number of samples, extracts clean tags that categorize the samples. AVClass2 uses, and helps building, an open taxonomy that organizes concepts in AV labels, but is not constrained to a predefined set of tags. To keep itself updated as AV vendors introduce new tags, it provides an update module that automatically identifies new taxonomy entries, as well as tagging and expansion rules that capture relations between tags. We have evaluated AVClass2 on 42M and showed how it enables advanced malware searches and to maintain an updated knowledge base of malware concepts in AV labels.
