In this paper, we explore the use of metric learning to embed Windows PE files in a low-dimensional vector space for downstream use in a variety of applications, including malware detection, family classification, and malware attribute tagging. Specifically, we enrich labeling on malicious and benign PE files using computationally expensive, disassembly-based malicious capabilities. Using these capabilities, we derive several different types of metric embeddings utilizing an embedding neural network trained via contrastive loss, Spearman rank correlation, and combinations thereof. We then examine performance on a variety of transfer tasks performed on the EMBER and SOREL datasets, demonstrating that for several tasks, low-dimensional, computationally efficient metric embeddings maintain performance with little decay, which offers the potential to quickly retrain for a variety of transfer tasks at significantly reduced storage overhead. We conclude with an examination of practical considerations for the use of our proposed embedding approach, such as robustness to adversarial evasion and introduction of task-specific auxiliary objectives to improve performance on mission critical tasks.

本研究旨在探讨采用度量学习将Windows PE文件嵌入到低维向量空间，以用于恶意软件检测、家族分类和恶意软件属性标记等应用程序，并通过比较弱相关性和计算负载等多种度量嵌入的方式，研究其性能在不同的转移任务中。实验结果表明，在一些任务中，这种低维度的嵌入方法维持了较好的性能并具备重训练能力，从而降低了存储开销。此外，我们还讨论了该方法的实际应用考虑事项，如对抗性逃避的鲁棒性和任务特定辅助目标的引入以提高关键任务的性能。

利用度量嵌入进行高效的恶意软件分析