论文标题
雷达：用于网络流量分析和恶意软件检测的基于TTP的可扩展，可解释且有效的系统
RADAR: A TTP-based Extensible, Explainable, and Effective System for Network Traffic Analysis and Malware Detection
论文作者
论文摘要
网络分析和机器学习技术已被广泛应用于构建恶意软件检测系统。尽管这些系统取得了令人印象深刻的结果，但它们通常是$（i）$不可扩展的，是整体上的，对它们设计的特定任务进行了很好的调整，但很难适应和/或扩展到其他设置，$（ii）$不可解释，是内在复杂性的黑匣子，其内部复杂性使人们无法发现其根源的结果，从而进一步分析了质疑的质疑。在本文中，我们介绍了一种可扩展且可解释的系统，可利用流行的TTP（策略，技术和程序）本体论的对手行为的本体论，以使用网络流量对恶意行为进行明确的识别和分类。我们在一个非常大的数据集中评估了雷达，其中包括2,286,907个恶意和良性样本，总计84,792,452网络流。实验分析证实，可以有效利用所提出的方法：雷达检测恶意软件的能力与其他最先进的非解剖系统的功能相当。据我们所知，Radar是第一个基于TTP的恶意软件检测系统，该系统使用机器学习，同时可扩展和解释。
Network analysis and machine learning techniques have been widely applied for building malware detection systems. Though these systems attain impressive results, they often are $(i)$ not extensible, being monolithic, well tuned for the specific task they have been designed for but very difficult to adapt and/or extend to other settings, and $(ii)$ not interpretable, being black boxes whose inner complexity makes it impossible to link the result of detection with its root cause, making further analysis of threats a challenge. In this paper we present RADAR, an extensible and explainable system that exploits the popular TTP (Tactics, Techniques, and Procedures) ontology of adversary behaviour described in the industry-standard MITRE ATT\&CK framework in order to unequivocally identify and classify malicious behaviour using network traffic. We evaluate RADAR on a very large dataset comprising of 2,286,907 malicious and benign samples, representing a total of 84,792,452 network flows. The experimental analysis confirms that the proposed methodology can be effectively exploited: RADAR's ability to detect malware is comparable to other state-of-the-art non-interpretable systems' capabilities. To the best of our knowledge, RADAR is the first TTP-based system for malware detection that uses machine learning while being extensible and explainable.
