REVIEW OF MACHINE LEARNING METHODS AND DETERMINATION OF RECOGNITION PIPELINE COMPONENTS FOR MALWARE OBFUSCATION TECHNIQUES

Malware obfuscation techniques are increasingly recognized with machine learning. Yet design decisions, such as whether to run the sample, which features to take and which model to use, are still driven by the available tools rather than by the properties of the technique itself. The article orders the existing approaches by feature type and model architecture and identifies for each the covered values of the faceted taxonomy of obfuscation techniques. Three systemic gaps are found. Models recognize techniques singly or as fixed combinations, although a sample usually contains several. No model combines file features with program behaviour features. Training sets are mostly built by researchers themselves, so quality drops on real-world samples, and anti-analysis techniques common in the wild are almost absent. A mapping from the taxonomy dimensions onto five recognition pipeline components is proposed: analysis type, model architecture, feature set, dynamic analysis strategy and observation environment requirements. For samples with several techniques, rules for uniting their taxonomy values are formulated. Each of the five links is rated as justified theoretically, confirmed by independent studies or remaining a hypothesis to be tested. The mapping allows a recognition system to be designed according to the properties of the technique used.