Detecting malware communities using socio-cultural cognitive mapping

Analysis of Malware Communities Using Multi-Modal Features

“…This suggests that even though the Deep Panda samples are all one homogeneous family of malware, that this malware has some distinct differences within the family. This result is largely consistent with other analysis of the communities in Sakula virus family of malware [5]. Also, in all modes except the Byte Entropies, the Dukes malware also displays a distinct, large community.…”

“…More interestingly, the majority of samples between the Dukes and Depp Panda threat actors break into two clusters. In the case of Deep Panda, previous research on characterizing communities from malware samples found a similar result of their being actually two main communities of malware present in the Deep Panda threat group [5]. Thus, it may be possible that the Dukes and Deep Panda threat actors are more heterogeneous than the APT-1 in terms of their malware usage.…”

“…One of the most promising set of static features from a malware classification standpoint were those proposed by Berlin and Saxe in [4]. These features have been shown to give state of art performance in supervised learning of malware samples [4] as well as being useful for characterizing malware samples within a threat actor group in an unsupervised learning paradigm [5]. Despite the prevalence and variety of malware features available, most approaches in use today use an early integration approach with the different modes of the data.…”

“…The features from Berlin and Saxe come from a deep neural network-based extraction method that uses four static feature domains. In previous works these features have been show to achieve high accuracy malware classification results [4], as well as provide insight into malware communities present in a threat actor group through clustering [5]. The four categories of features are Byte Entropies, Import Address Table , String Hashes, and Portable Executable (P.E.)…”