Malware triage for early identification of Advanced Persistent Threat activities

by   Giuseppe Laurenza, et al.

In the last decade, a new class of cyber-threats has emerged. This new cybersecurity adversary is known with the name of "Advanced Persistent Threat" (APT) and is referred to different organizations that in the last years have been "in the center of the eye" due to multiple dangerous and effective attacks targeting financial and politic, news headlines, embassies, critical infrastructures, TV programs, etc. In order to early identify APT related malware, a semi-automatic approach for malware samples analysis is needed. In our previous work we introduced a "malware triage" step for a semi-automatic malware analysis architecture. This step has the duty to analyze as fast as possible new incoming samples and to immediately dispatch the ones that deserve a deeper analysis, among all the malware delivered per day in the cyber-space, the ones that really worth to be further examined by analysts. Our paper focuses on malware developed by APTs, and we build our knowledge base, used in the triage, on known APTs obtained from publicly available reports. In order to have the triage as fast as possible, we only rely on static malware features, that can be extracted with negligible delay, and use machine learning techniques for the identification. In this work we move from multiclass classification to a group of oneclass classifier, which simplify the training and allows higher modularity. The results of the proposed framework highlight high performances, reaching a precision of 100


page 1

page 2

page 3

page 4


Devising Malware Characterstics using Transformers

With the increasing number of cybersecurity threats, it becomes more dif...

AI assisted Malware Analysis: A Course for Next Generation Cybersecurity Workforce

The use of Artificial Intelligence (AI) and Machine Learning (ML) to sol...

Deep Learning and Open Set Malware Classification: A Survey

As the Internet is growing rapidly these years, the variant of malicious...

Portable, Data-Driven Malware Detection using Language Processing and Machine Learning Techniques on Behavioral Analysis Reports

In response to the volume and sophistication of malicious software or ma...

A First Look at the Crypto-Mining Malware Ecosystem: A Decade of Unrestricted Wealth

Illicit crypto-mining leverages resources stolen from victims to mine cr...

End-to-End Deep Neural Networks and Transfer Learning for Automatic Analysis of Nation-State Malware

Malware allegedly developed by nation-states, also known as advanced per...

Ontology-driven Knowledge Graph for Android Malware

We present MalONT2.0 – an ontology for malware threat intelligence <cit....

Please sign up or login with your details

Forgot password? Click here to reset