As a result of decades of research, Windows malware detection is approached through a plethora of techniques. However, there is an ongoing mismatch between academia -- which pursues an optimal performances in terms of detection rate and low false alarms -- and the requirements of real-world scenarios. In particular, academia focuses on combining static and dynamic analysis within a single or ensemble of models, falling into several pitfalls like (i) firing dynamic analysis without considering the computational burden it requires; (ii) discarding impossible-to-analyse samples; and (iii) analysing robustness against adversarial attacks without considering that malware detectors are complemented with more non-machine-learning components. Thus, in this paper we propose SLIFER, a novel Windows malware detection pipeline sequentially leveraging both static and dynamic analysis, interrupting computations as soon as one module triggers an alarm, requiring dynamic analysis only when needed. Contrary to the state of the art, we investigate how to deal with samples resistance to analysis, showing how much they impact performances, concluding that it is better to flag them as legitimate to not drastically increase false alarms. Lastly, we perform a robustness evaluation of SLIFER leveraging content-injections attacks, and we show that, counter-intuitively, attacks are blocked more by YARA rules than dynamic analysis due to byte artifacts created while optimizing the adversarial strategy.

翻译：历经数十年研究，Windows恶意软件检测已涌现出大量技术方法。然而，学术界追求检测率与低误报率的最优性能，这与实际场景需求之间始终存在脱节。具体而言，当前研究聚焦于将静态分析与动态分析结合在单一或集成模型中，却陷入以下困境：(i) 启动动态分析时未充分考虑其计算负担；(ii) 直接丢弃无法分析的样本；(iii) 评估对抗攻击鲁棒性时，未考虑恶意软件检测器实际包含大量非机器学习组件。为此，本文提出SLIFER——一种新型Windows恶意软件检测流程，其顺序调用静态与动态分析模块，并在任一模块触发警报时立即终止计算，仅在必要时执行动态分析。与现有技术不同，我们深入研究了如何处理抗分析样本，量化了其对性能的影响，最终论证将其标记为合法样本可避免误报率急剧上升。最后，我们通过内容注入攻击对SLIFER进行鲁棒性评估，结果表明：由于优化对抗策略时产生的字节伪影，YARA规则反而比动态分析能更有效地阻断攻击，这一发现与直觉相悖。