BigBing: Privacy-Preserving Cloud-Based Malware Classification Service

Abstract

Although cloud-based malware defense services have made significant contributions to thwarting malware attacks, there have been privacy concern over using these services to analyze suspicious files which may contain user-sensitive data. We develop a new platform called BigBing (a big data approach to binary code genomics) to offer a privacy-preserving cloud-based malware classification service. BigBing relies on a community of contributors who would like to share their binary executables, and uses a novel blockchain-based scheme to ensure the privacy of possibly user-sensitive data contained within these files. To scale up malware defense services, BigBing trains user-specific classification models to detect malware attacks seen in their environments. We have implemented a prototype of BigBing, comprised of a big data cluster, a pool of servers for feature extraction, and a frontend gateway that facilitates the interaction between users and the BigBing backend. Using a real-world malware dataset, we evaluate both execution and classification performances of the service offered by BigBing. Our experimental results demonstrate that BigBing offers a useful privacy-preserving cloud-based malware classification service to fight against the ever-growing malware attacks.