Toward Identifying APT Malware through API System Calls

Abstract

Self-developed malware was usually used by advanced persistent threat (APT) attackers to launch APT attacks. Therefore, we can enhance the understanding and cognition of APT attacks by comprehending the behavior of APT malware. Unfortunately, the current research cannot effectively explain the relationship between the recognition, detection, and defense of APT. The model of similar studies also lacks an explanation about it. To defend against APT attacks and inquire about the similarity of different APT attacks, this study proposes an APT malware classification method based on a combination of multiple deep learning algorithms and transfer learning by collecting malware used in several famous APT groups in public. By extracting the application programming interface (API) system calls, with the vector representation of features by combining dynamic LSTM and attention algorithm, we can obtain API at different APT families classification contributions trained dynamic. Thus, we used transfer learning to perform multiple classifications of the APT family. This study aims to reduce the burden of network security staff from reviewing a large number of suspicious files when defending against APT attacks. Additionally, it can effectively intercept them in the initial invasion stage of APT to perform targeted defense against specific APT attacks by combining threat intelligence in public. The experimental result shows that the proposed method can achieve 99.2% in distinguishing common malware from APT malware and assign APT malware to different APT families with an accuracy of 95.5%.

Research on deep-learning-based techniques for advanced persistent threat malware detection and attribution

“…In terms of machine learning and deep learning applications, Ishai R et al [10] traced APT organizations using deep neural networks (DNN). Wei C et al [11] extracted API system calls as features and employed a dynamic LSTM algorithm with attention mechanism to classify these APT malware organizations. Chen Y et al [12] extracted PE static features and applied deep forests and convolutional neural networks to identify APT malware organizations.…”

Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

“…In [12], researchers developed a traceability system, from the perspective of the calling relationship between hosts and processes, to detect anomalies by monitoring the calling relationship. Some provenance tracking systems are proposed to monitor and analyse the activities of the system [13][14][15][16]. However, the long time interval and low-profile characteristics of complex behaviours of APT kind of unknown attacks make them still face the low detecting success rate problem.…”

Attack Graph Generation with Machine Learning for Network Security

“…These kinds of attacks are the most damaging and worrying type of attack because they are difficult to detect and are continuously attempted [4][5][6][7][8]. These attacks come through the vulnerable system in the network, and even if the system containing important assets is primarily protected from the attacker, the system cannot be protected if it is accessible through the vulnerable system inside the network [4][5][6][7][8][9][10][11][12].…”

“…Recently, in particular, as the Internet of Things (IoT) has been widely used, more and more vulnerable systems have proliferated inside the network [9][10][11][12][13]. As the risk of cyberattacks increases, companies and institutions are introducing various security systems to protect information assets, and are making efforts to maintain a safe network.…”

“…As the risk of cyberattacks increases, companies and institutions are introducing various security systems to protect information assets, and are making efforts to maintain a safe network. However, responding to the latest attack types that are continuously evolving and developing still remain a difficult problem [2,3,[8][9][10][11][12]. In particular, the exponentially increasing vulnerabilities of the latest systems are becoming obstacles in keeping the system safe from cyberattacks.…”