MalFocus: Locating Malicious Modules in Malware Based on Hybrid Deep Learning

In recent years, binary malware detection has attracted extensive attention from industry and academia. However, most of the existing work only focuses on judging whether a sample is malicious or not, rather than identifying malicious modules in malware. Few studies aiming at locating malicious code work on the function granularity and suffer from inaccuracy. In this article, we address this problem by locating malicious code at the functional module (FM) granularity, which combines several functions to express the malicious behaviors of malware. We design a tool called MalFocus to automatically divide malware into FMs and then identify the malicious functional module (MFM) in a multi-model hybrid manner, in which an unsupervised model and an interpretability approach based on a binary classifier are combined, eliminating the workload of labeling malware samples, determining the scope of MFMs and ranking them according to their maliciousness. The identified MFMs are then passed to security analysts for verification, helping to significantly reduce the scope of manual analysis while providing a comprehensive view of the malware attack flow. Additionally, rules derived from the verified MFMs can be used to detect variants and new malware families with different functionalities, offering a more general and flexible detection approach. We evaluate MalFocus's performance on 6764 real-world samples. The results show that MalFocus can correctly identify 95% of MFMs, outperforming current state-of-the-art work.