Bifocal Agent: enhancing malicious function detection in malware analysis.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Malware analysis is a manual bottleneck, with current automated methods often yielding high false positives.
• Existing anomaly-based detection struggles with identifying suspicious code regions effectively.

Purpose of the Study:

• To develop an unsupervised method for automatic detection of malicious components in executable files.
• To improve the accuracy and reduce false positives in malware analysis.

Main Methods:

• The Bifocal Agent analyzes Windows PE executables at function and basic block granularities using an autoencoder.
• It employs semantic-aware features and a novel reconstruction error aggregation strategy.
• The method uses multi-granularity consensus for enhanced detection.

Main Results:

• Achieved a 20% increase in ROC AUC (0.73 to 0.88) and a 154% improvement in area under the precision-recall curve (0.13 to 0.32) on malware datasets.
• Outperformed the DeepReflect approach and reduced false positives by 52% while maintaining an 80% true positive rate.
• On a large-scale dataset, increased the Matthews correlation coefficient by 3.1 times and reduced the false positive rate from 45% to 16%.

Conclusions:

• The Bifocal Agent effectively detects malicious code regions by analyzing executables at multiple granularities.
• This unsupervised approach offers a significant advancement in automated malware analysis, outperforming state-of-the-art methods.
• The framework demonstrates strong generalization capabilities and practical applicability in real-world scenarios.