For a long time, malware classification and analysis have been an arms-race between antivirus systems and malware authors. Though static analysis is vulnerable to evasion techniques, it is still popular as the first line of defense in antivirus systems. But most of the static analyzers failed to gain the trust of practitioners due to their black-box nature. We propose MAlign, a novel static malware family classification approach inspired by genome sequence alignment that can not only classify malware families but can also provide explanations for its decision. MAlign encodes raw bytes using nucleotides and adopts genome sequence alignment approaches to create a signature of a malware family based on the conserved code segments in that family, without any human labor or expertise. We evaluate MAlign on two malware datasets, and it outperforms other state-of-the-art machine learning based malware classifiers (by 4.49% - 0.07%), especially on small datasets (by 19.48% - 1.2%). Furthermore, we explain the generated signatures by MAlign on different malware families illustrating the kinds of insights it can provide to analysts, and show its efficacy as an analysis tool. Additionally, we evaluate its theoretical and empirical robustness against some common attacks. In this paper, we approach static malware analysis from a unique perspective, aiming to strike a delicate balance among performance, interpretability, and robustness.

翻译：长期以来，恶意软件分类与分析一直是反病毒系统与恶意软件作者之间的技术博弈。尽管静态分析易受逃避技术攻击，但作为反病毒系统的第一道防线仍被广泛采用。然而，大多数静态分析器因其黑盒特性而难以获得从业者的信任。我们提出MAlign——一种受基因组序列对齐启发的创新静态恶意软件家族分类方法，该方法不仅能对恶意软件家族进行分类，还能为其决策提供可解释性。MAlign使用核苷酸对原始字节进行编码，并采用基因组序列对齐方法，基于家族中保守的代码片段创建恶意软件家族签名，无需任何人工干预或专业知识。我们在两个恶意软件数据集上评估MAlign，结果显示其性能优于其他最先进的基于机器学习的恶意软件分类器（提升4.49%-0.07%），尤其在小型数据集上表现突出（提升19.48%-1.2%）。此外，我们通过不同恶意软件家族的生成签名阐释MAlign能为分析人员提供的洞见类型，展示了其作为分析工具的有效性。我们还从理论与实证两个维度评估了该方法对常见攻击的鲁棒性。本文从独特视角切入静态恶意软件分析，旨在性能、可解释性与鲁棒性之间取得精妙平衡。