Curator - A system for creating data sets for behavioral malware detection

摘要

Detecting malware during execution using machine learning models presents some hard-to-solve problems relating to data set construction seldom discussed in the literature. We identify, name these problems and show our solutions to them in the form of Curator, a specialized distributed system for detonating potentially malicious programs, extracting behavior information, and correctly labeling said behavior to construct an accurate, consistent, and reliable data set. We demonstrate Curator’s need by using generated data sets to train machine learning models based on Naive Bayes, Logistic Regression, and Random Forests. Our work is currently focused on the Windows operating system.