A Monte Carlo Tree Search approach to Active Malware Analysis

A Monte Carlo Tree Search approach to Active Malware Analysis

Riccardo Sartea, Alessandro Farinelli

Proceedings of the Twenty-Sixth International Joint Conference on Artificial Intelligence
Main track. Pages 3831-3837. https://doi.org/10.24963/ijcai.2017/535

Active Malware Analysis (AMA) focuses on acquiring knowledge about dangerous software by executing actions that trigger a response in the malware. A key problem for AMA is to design strategies that select most informative actions for the analysis. To devise such actions, we model AMA as a stochastic game between an analyzer agent and a malware sample, and we propose a reinforcement learning algorithm based on Monte Carlo Tree Search. Crucially, our approach does not require a pre-specified malware model but, in contrast to most existing analysis techniques, we generate such model while interacting with the malware. We evaluate our solution using clustering techniques on models generated by analyzing real malware samples. Results show that our approach learns faster than existing techniques even without any prior information on the samples.
Keywords:
Multidisciplinary Topics and Applications: AI&Security and Privacy
Machine Learning: Reinforcement Learning
Agent-based and Multi-agent Systems: Noncooperative Games