eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys

Abstract

For years security machine learning research has promised to obviate the need for signature based detection by automatically learning to detect indicators of attack. Unfortunately, this vision hasn't come to fruition: in fact, developing and maintaining today's security machine learning systems can require engineering resources that are comparable to that of signature-based detection systems, due in part to the need to develop and continuously tune the "features" these machine learning systems look at as attacks evolve. Deep learning, a subfield of machine learning, promises to change this by operating on raw input signals and automating the process of feature design and extraction. In this paper we propose the eXpose neural network, which uses a deep learning approach we have developed to take generic, raw short character strings as input (a common case for security inputs, which include artifacts like potentially malicious URLs, file paths, named pipes, named mutexes, and registry keys), and learns to simultaneously extract features and classify using character-level embeddings and convolutional neural network. In addition to completely automating the feature design and extraction process, eXpose outperforms manual feature extraction based baselines on all of the intrusion detection problems we tested it on, yielding a 5%-10% detection rate gain at 0.1% false positive rate compared to these baselines.

References in corpus (2)

• Neural Machine Translation in Linear Time
• Malicious Behavior Detection using Windows Audit Logs

Cited by in corpus (16)

• VulDeePecker: A Deep Learning-Based System for Vulnerability Detection
• Malicious URL Detection using Machine Learning: A Survey
• URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection
• Machine Learning in Cyber-Security - Problems, Challenges and Data Sets
• Analyzing the Real-World Applicability of DGA Classifiers
• MaskDGA: A Black-box Evasion Technique Against DGA Classifiers and Adversarial Defenses
• The More, the Better? A Study on Collaborative Machine Learning for DGA Detection
• Improving Native Ads CTR Prediction by Large Scale Event Embedding and Recurrent Networks
• Learning from Context: Exploiting and Interpreting File Path Information for Better Malware Detection
• Nested Multiple Instance Learning in Modelling of HTTP network traffic
• AMSI-Based Detection of Malicious PowerShell Code Using Contextual Embeddings
• When deep learning meets security
• Artificial Neural Network for Cybersecurity: A Comprehensive Review
• Training Transformers for Information Security Tasks: A Case Study on Malicious URL Prediction
• A Deep Learning Approach to Fast, Format-Agnostic Detection of Malicious Web Content
• Malicious Requests Detection with Improved Bidirectional Long Short-term Memory Neural Networks