Categorização de malware em binários utilizando técnicas de NLP e deep learning

Abstract

The use of technology has been steadily increasing over the years, and its potential to expedite tasks in our current era is proving to be significant. Individuals, businesses, and even nations have experienced a transformation in their daily activities, often leading to improvements. However, this transformation comes with a downside: dependency. The lack of technologies for communication, financial transactions, or the provision of essential resources can result in substantial financial losses or even loss of life. One of the key factors driving this technological shift is software. Currently, the most widely used operating system is Windows, which supports software in the PE32 format. Unfortunately, due to its popularity, this format is often exploited by malicious users to create harmful software. According to VirusTotal, PE32 remains the primary format for such malicious applications today. Currently, there are several techniques for analyzing malware in the PE32 format, which can be categorized into two types: static and dynamic analysis. Static analysis involves examining the characteristics of the binary without executing it. In contrast, dynamic analysis requires the execution of the binary while extracting information during its runtime. Both analyses are important, but in modern automated environments, speed is crucial. This project proposes using natural language processing (NLP) and deep learning techniques to analyze malware code from binaries in PE32 format, which are extracted through disassembly methods. The goal is to categorize malware, allowing known threats to be directed toward more thorough analyses. This approach aims to create a malware categorization structure that can enhance situational awareness and support decision-making. Word2Vec is a natural language processing (NLP) algorithm that converts words into numerical representations based on the patterns in which they appear. This technique can be used to classify malware based on its assembly code. For this purpose, Word2Vec will be trained using functions extracted from binaries in PE32 format. The resulting output will then be input to a Long Short-Term Memory (LSTM) recurrent neural network model, which will identify patterns and classify the malware effectively through machine learning techniques.