Malware Triage for Early Identification of Advanced Persistent Threat Activities

Abstract

In the past decade, a new class of cyber-threats, known as "Advanced Persistent Threat" (APT), has emerged and has been used by different organizations to perform dangerous and effective attacks against financial and politic entities, critical infrastructures, and so on. To identify APT related malware early, a semi-automatic approach for malware samples analysis is needed. Recently, a malware triage step for a semi-automatic malware analysis architecture has been introduced. This step identifies incoming APT samples early, among all the malware delivered per day in the cyber-space, to immediately dispatch them to deeper analysis. In the article, the authors have built the knowledge base on known APTs obtained from publicly available reports. For efficiency reasons, they rely on static malware features, extracted with negligible delay, and use machine learning techniques for the identification. Unfortunately, the proposed solution has the disadvantage of requiring a long training time and needs to be completely retrained each time new APT samples or even a new APT class are discovered. In this article, we move from multi-class classification to a group of one-class classifiers, which significantly decreases runtime and allows higher modularity, while still guaranteeing precision and accuracy over 90%. CCS Concepts: • Social and professional topics → Malware/spyware crime;

Identifying Authorship Style in Malicious Binaries: Techniques, Challenges & Datasets

“…This concurs with the rest of the field [50,22,58,77,44]. Seven papers consider three alternative ML methods: clustering, anomaly detection and structured prediction techniques [106,66,80,78,7,8,47]. We explore these further as they show promise towards the open-world problem.…”

“…Our search criteria looked for work which addressed the problem of binary and malware authorship attribution. We omitted any papers which performed a binary classification on malware and contained no significant contribution on authorship styles to malicious files, e.g., we omit the paper [65] as this classifies malware into APT group or non-APT group but we include [66] as this classifies malware into specific APT groups. We identified eighteen papers which possess a significant relationship with MAA, and we contacted all authors whose systems were not publicly available.…”

Toward Identifying APT Malware through API System Calls

“…However, the method to judge the priority of API is based on prior knowledge, which may lead to a deviation. Laurenza et al [3] relied on the static characteristics of malware and designed a malware classification framework based on the concept of isolation forest learning. ey trained each isolation forest with specific APT samples using only static features.…”

“…Similar to traditional network attacks, APT attackers must use malware as attack weapons to attack in cyberspace [2]. However, unlike traditional network attacks, APT attacks will use some independent development malware to achieve specific purposes against different targets [3]. is malware is collectively called APT malware [4].…”

“…Currently, there are two methods for solving this problem: dynamic and static analyses [9]. It means training the classification model by extracting dynamic or static features [2,3,7,8,10,11]. Static analysis technology can inspect executable programs without actual execution samples; the main advantage it has is that it is not affected by execution expenses, whereas dynamic analysis is to observe executable programs in real or virtual execution environments and monitor actual malicious acts [12].…”