What are the overall features used in static analysis of malware? Is file property among the features used in static analysis of malware?

Question

I was looking at the paper: "Improved Detection for Advanced Polymorphic Malware" by James Fraley who claimed to have used static, dynamic and file properties for increased malware detection. But is file property not a static feature?

Answer 1

The author does not appear to explicitly explain what "file properties" are, but some of the papers cited in relation to "file properties" discuss the role of malware families in machine-learning based approaches to malware detection.

It is possible that the author does not provide a clear description of what is meant by "file properties" because the term is being used as a buzzword ("Static analysis, dynamic analysis and file properties? How exciting and novel!") such that it has no real technical meaning and is employed to draw attention to some aspect of the research deemed new or original. This seems to happen frequently in research investigating applications of machine learning to information security challenges.

Here are some of the papers cited in relation to the author's use of the term "file properties":

• Subramanya, S. R., & Lakshminarasimhan, N. (2001). Computer viruses. IEEE Potentials, 20(4), 18–21
• Hansen, S. S., Mark, T., Larsen, T., Stevanovic, M., & Pedersen, J. M. (2016). An Approach for Detection and Family Classification of Malware Based on Behavioral Analysis. 2016 International Conference on Computing; Networking and Communications (ICNC), (February), 1–5.
• Singh, A., Walenstein, A., & Lakhotia, A. (2012). Tracking concept drift in malware families. Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence - AISec ’12, 81–92.

---

Text of interest from page 79:

2. Manipulate feature set – the standard feature dataset was augmented to evaluate whether detection rates are improved after the intervention of features. A number of studies examined dynamic analysis (Rieck, Trinius, Willems, & Holz, 2011), static analysis (Kerchen et al., 1990) and file properties (Subramanya & Lakshminarasimhan, 2001). The study examined three multidimensional datasets. The three datasets were generated by combining known malware, known benign and unknown samples into single feature dataset. Once the baseline was generated, the feature weighting was manipulated to see if detection rates would improve (Siddiqui, 2008).

Text of interest from page 99:

Polymorphic malware may call libraries or use functions available through the operating system such as Microsoft’s dynamic link libraries (DLLs) (Egele, Scholte, Kirda, & Kruegel, 2012). The intended use or abuse of such functions by malware can be linked to file properties of the malware itself (Hansen et al., 2016). Therefore, experiments conducted during this phase, added various features from file properties to those of dynamic-static occurrence tests performed previously. Previous research has shown that there exists a number of “metadata” properties that can be used for malware detection (Kamongi, Kotikela, Kavi, Gomathisankaran, & Singhal, 2013) and (A. Singh et al., 2012). This study found similar results. This study performed extended static to dynamic occurrence testing with all three advanced clustering algorithms (MB, IBk and DLMLP).