Analysis of Malware Communities Using Multi-Modal Features

Abstract

Identifying possible threat actors from samples of malware remains an active area of research with important ramifications for cybersecruity practitioners. The unsupervised identification and characterization of malware samples has been primarily treated as an early integration, multi-modal clustering problem where all possible features derived from the samples are concatenated into one feature vector, which can then be fed into a standard unsupervised learning algorithm. In this work, we focus on characterizing malware samples into possible threat actors from both late integration and intermediate integration multi-modal data perspectives. In doing so, we propose a new algorithm, Cross-Modal Influence Clustering, for characterizing malware samples into threat actor groups. We test our proposed method along with several other multimodal clustering techniques on heterogeneous malware samples from three different threat actors. Our results indicate that our proposed method is the best method for clustering malware samples into threat actors in an unsupervised setting and that we observe consistently better results in characterizing malware samples by threat actors from intermediate or late integration multi-modal paradigms rather than an early integration one.INDEX TERMS Cybersecurity, malware, multi-modal data, network diffusion, unsupervised machine learning, multi-view data.

Attention-Based Cross-Modal CNN Using Non-Disassembled Files for Malware Classification

“…Many models that use images and text simultaneously typically adopt multi-modal learning [29]. There are malware classification models based on multimodal learning [4], [10], [30]. Gibert et al [10] combined API calls, raw bytes, and opcodes using the late fusion method to exploit low-level and high-level information to enhance classification performance.…”

“…They used static API sequences extracted from disassembled files and dynamic API sequences logged during the runtime. In [30], the malware was identified by a multi-modal clustering algorithm using a PE header, string hashes, IAT, and byte entropy. Recently, cross-modal learning [31], [32], [29], a new multi-modal learning method that focuses on the adaptive combination of multiple modalities, has emerged.…”

Threat Actors’ Tenacity to Disrupt: Examination of Major Cybersecurity Incidents

“…Malware is a software that harmfully attacks other software in ways that causes the actual behavior to differ from the intended behavior [24]. Threat actors tend to use this type of method to execute many attacks that could be in form of viruses, ransomware, trojans, remote access trojans (RAT), advanced persistent threats (APT) and the list goes on [25], [26], [27].…”

Design and Analysis of Network Virus Defense System Based on Multimodal Data Mining Technology

“…With the continuous update and popularization of network information, people have more and more opportunities to use the network in life and work, which also makes network security a major issue that is urgently needed at the moment [1,2]. Particularly in recent years, large-scale computer virus infections with great destructiveness have emerged one after another [3].…”