Cuckoo Sandbox Research Articles

Enhancing Malware Detection by Integrating Machine Learning with Cuckoo Sandbox

In this work, two categories of deep learning and conventional machine learning were used to classify malware using a dataset of all possible API call sequences. Specifically, the objective was to determine the best strategy to tackle the ever-rising menace as malware becomes more complex. A new dataset was created employing Cuckoo Sandbox, where API call sequences originating from both benign and malware samples were recorded. The performance of these algorithms was benchmarked and tested using this dataset, which includes SVM, RF, KNN, XGB, GBC, CNN, and RNN. The study established that both deep learning and conventional machine learning algorithms provided high accuracy above 90%. Specifically, the recurrent neural networks (RNNs) demonstrated high accuracy rates ranging from 95% to 99%. These results are highly indicative of deep learning, especially RNN, as a promising approach to improving the effectiveness of malware detection. The data obtained from dynamic analysis, when integrated into a database, serves as a more reliable source for training and testing of such models, and can improve the model’s ability to identify new threats posed by malware. Thus, this work is salient in enhancing the development of new approaches to fight malware that constantly evolve in the modern world.

Artificial Intelligence and Malicious Code Detection

Malicious software has become a critical cybersecurity issue due to the increasing number of threats it poses to devices and internet environments. Traditional static scanning techniques and behavior-based malware detection methods have limitations in meeting the new requirements in information security due to high false positives and false negatives. In this work, we propose a CNN convolutional neural network-based method for detecting malicious code. Practical operations were conducted using the Cuckoo sandbox system, and Python programs were utilized to preprocess analytical reports. This article presents the construction of a deep learning training model for CNN designed to identify malicious code. The model is compared with machine learning and general antivirus tools for comprehensive evaluation. Experimental verification shows that our proposed method exhibits greater advantages in comparison and achieved excellent detection results with higher feasibility. The research significance of this work is highlighted as malicious software has become a core issue in cybersecurity. The method proposed in this article provides powerful support for addressing new needs in information security. This paper emphasizes the importance of utilizing CNN-based methods in detecting malware, which can better address the limitations of traditional detection techniques. Overall, this work provides an effective solution to detect malicious code and addresses a critical cybersecurity issue.

Exploring Cyber Threats and Threat Actors in the Financial Sector: A Comprehensive Study

This paper aims to discuss the recent activities of Financially motivated Threat actors and gather IOCs and Threat Intelligence based on the same. Common TTPs are mapped for 18 FIN threat actor groups along with known mitigations as per MITRE Attack Framework. In particular, FIN 7 is discussed in detail, including the lifecycle of Qakbot Malware and malwares are analyzed to gather IOCs using Static Analysis. Intrusion Detection Systems (Snort and YARA) are drafted for Qakbot. A comprehensive analysis on Diamond Model, Kill Chain and Pyramid of Pain is performed for Qakbot Malware and mitigations are mapped to MITRE ATTACK framework. Threat intelligence is gathered on the 1000 latest samples of Qakbot to deep dive into most commonly used delivery methods, malware file types and a timeline analysis is conducted. Advanced tools like OpenCTI and Cuckoo Sandbox are utilized to give an overall analysis on Financially motivated threat actors

MalFe—Malware Feature Engineering Generation Platform

The growing sophistication of malware has resulted in diverse challenges, especially among security researchers who are expected to develop mechanisms to thwart these malicious attacks. While security researchers have turned to machine learning to combat this surge in malware attacks and enhance detection and prevention methods, they often encounter limitations when it comes to sourcing malware binaries. This limitation places the burden on malware researchers to create context-specific datasets and detection mechanisms, a time-consuming and intricate process that involves a series of experiments. The lack of accessible analysis reports and a centralized platform for sharing and verifying findings has resulted in many research outputs that can neither be replicated nor validated. To address this critical gap, a malware analysis data curation platform was developed. This platform offers malware researchers a highly customizable feature generation process drawing from analysis data reports, particularly those generated in sandbox-based environments such as Cuckoo Sandbox. To evaluate the effectiveness of the platform, a replication of existing studies was conducted in the form of case studies. These studies revealed that the developed platform offers an effective approach that can aid malware detection research. Moreover, a real-world scenario involving over 3000 ransomware and benign samples for ransomware detection based on PE entropy was explored. This yielded an impressive accuracy score of 98.8% and an AUC of 0.97 when employing the decision tree algorithm, with a low latency of 1.51 ms. These results emphasize the necessity of the proposed platform while demonstrating its capacity to construct a comprehensive detection mechanism. By fostering community-driven interactive databanks, this platform enables the creation of datasets as well as the sharing of reports, both of which can substantially reduce experimentation time and enhance research repeatability.

RBEF: Ransomware Efficient Public Blockchain Framework for Digital Healthcare Application.

These days, the use of digital healthcare has been growing in practice. Getting remote healthcare services without going to the hospital for essential checkups and reports is easy. It is a cost-saving and time-saving process. However, digital healthcare systems are suffering from security and cyberattacks in practice. Blockchain technology is a promising technology that can process valid and secure remote healthcare data among different clinics. However, ransomware attacks are still complex holes in blockchain technology and prevent many healthcare data transactions during the process on the network. The study presents the new ransomware blockchain efficient framework (RBEF) for digital networks, which can identify transaction ransomware attacks. The objective is to minimize transaction delays and processing costs during ransomware attack detection and processing. The RBEF is designed based on Kotlin, Android, Java, and socket programming on the remote process call. RBEF integrated the cuckoo sandbox static and dynamic analysis application programming interface (API) to handle compile-time and runtime ransomware attacks in digital healthcare networks. Therefore, code-, data-, and service-level ransomware attacks are to be detected in blockchain technology (RBEF). The simulation results show that the RBEF minimizes transaction delays between 4 and 10 min and processing costs by 10% for healthcare data compared to existing public and ransomware efficient blockchain technologies healthcare systems.

Ransomware Detection by Distinguishing API Call Sequences through LSTM and BERT Models

Abstract Nowadays, ransomware evolved rapidly and the prevention of ransomware has become an important issue. The threat of ransomware is much more sophisticated than before for governments and enterprises; breaches or corruption of sensitive data will cause huge impact on the organization. Early detection is one of the effective method to prevent the ransomware attack. Modern ransomware detection technologies can be divided into two categories: static analysis and dynamic analysis. Dynamic analysis observes the behavior of the running program. Previous research adopted machine learning approach for dynamic analysis and API sequence dataset were used to trained machine learning models for dynamic analysis. In this research, we collected the API calls of the ransomware from reports generated by Cuckoo Sandbox and proposed two detecting models using BERT and LSTM. The result shows that both BERT and LSTM models can successfully predict ransomware with 95% high accuracy. We aimed to compare the performance of two text-based learning model, LSTM and BERT, and analyze the pros and cons. The result shows that API sequence data can be used to train effective ransomware detection models in text-based manner.

Automated Windows behavioral tracing for malware analysis

AbstractIn malware analysis, there are two problem scenarios—detection and prevention. In prevention, analysts try to quarantine the file before it gets executed in a real system. The file is further analyzed in a sandbox to observe the behavior. Hence, our work shows that our agent captures events for malware analysis. After integration with the sandbox, it produces robust and efficient models. ETW is a Windows in‐build tool with kernel‐level access. We develop an agent using ETW in C++ with proper usage details. We collect data using cuckoo sandbox and ETW agent for 11 546 samples and perform comparative frequency analysis. The performance of various machine learning classifiers is examined on the behavioral data. Random Forest classifier performs the best on the combined (cuckoo+ETW) data with an accuracy of 99.68% and FPR of 0.45%. The improved performance of combined data over cuckoo data on packed and un‐seen malware is also significantly good. In the detection, if malware somehow escapes from the deployed prevention mechanism and gets executed, the analyst tries to detect malicious actions and respond before it is too late. Our agent can tackle such issues and can function as a standalone host‐based monitoring agent to extract kernel‐level information.

Intrusion Detection in Cyber Space Using Machine Learning Based Algorithm

Now a day, the fast growth of Internet access and the adoption of smart digital technology has resulted in new cybercrime strategies targeting regular people and businesses. The Web and social activities take precedence in most aspects of their lives, but also poses significant social risks. Static and dynamic analysis are inefficient in detecting unknown malware in standard threat detection approaches. Virus makers create new malware by modifying current malware using polymorphic and evasion tactics in order to fool. Furthermore, by utilizing selection of features techniques to identify more important features and minimizing amount of the data, these Machine Learning models' accuracy can be increased, resulting in fewer calculations. In the previous study traditional machine learning approaches were used to detect Malware. We employed Cuckoo sandbox, a malware detection and analysis system for detection and categorization, in this study we provide a Machine Learning based Intrusion analysis system to calculate exact and on spot Intrusion classification. We integrated feature extraction and component selection from the file, as well as selecting the much higher quality, resulting in exceptional accuracy and cheaper computing costs. For reliable identification and fine-grained categorization, we use a variety of machine learning algorithms. Our experimental results show that we achieved good, classified accuracy when compared to state-of-the-art approaches. We employed machine learning techniques such as K-Nearest Neighbor, Random Forest, Support Vector Machine, and Decision Tree. Using the Random Forest classifier on 108 features, we attained the greatest accuracy of 99.37 percent. We also discovered that Random Forest outscored all other classic machine learning techniques during the procedure. These findings can aid in the exact and accurate identification of Malware families.

Using Static and Dynamic Malware features to perform Malware Ascription

Malware ascription is a relatively unexplored area, and it is rather difficult to attribute malware and detect authorship. In this paper, we employ various Static and Dynamic features of malicious executables to classify malware based on their family. We leverage Cuckoo Sandbox and machine learning to make progress in this research. Post analysis, classification is performed using various deep learning and machine learning algorithms. Using the features gathered from VirusTotal (static) and Cuckoo (dynamic) reports, we ran the vectorized data against Multinomial Naive Bayes, Support Vector Machine, and Bagging using Decision Trees as the base estimator. For each classifier, we tuned the hyper-parameters using exhaustive search methods. Our reports can be extremely useful in malware ascription.

Time-interval temporal patterns can beat and explain the malware

Malware-based cyber-attacks are mainly aimed at obtaining sensitive data, intellectual property theft, denying critical services and data, and financial gain. Malware has continuously evolved, becoming more sophisticated and evasive, and thus it remains a major cyber-security threat. To keep pace with malware’s evolution, there is a critical need to develop new, advanced malware detection methods. Widely-used solutions, such as antivirus software and other static host-based intrusion detection systems, have limitations, particularly in detecting new, unknown, and evasive malware. Many of the limitations of static analysis can be overcome when dynamic malware analysis is leveraged by machine learning (ML) algorithms by executing the malware in an isolated environment (e.g., sandbox), which enables the acquisition of rich behavioral and time-oriented information associated with malware behavior. Prior studies have proposed various detection methods based on dynamically extracted API calls for malware detection, but other than simple order-based approaches, the use of more advanced time-based methods has not been explored. In this paper, we propose a more comprehensive detection framework which, by analyzing the raw multivariate time-series data associated with malware execution, can accurately capture malware behavior and provide clear explainability regarding malware behavior and detection model decisions. We are the first to mine and automatically discover meaningful and explainable time-interval temporal API call patterns associated with malware behavior and leverage them, using a variety of ML algorithms, for malware detection and categorization. To evaluate our proposed solution, we established a comprehensive dynamic-analysis environment using Cuckoo Sandbox and analyzed more than 17,000 portable executables executed in Windows 10, the most widely-used operating system today. We conducted extensive experiments on malware detection and categorization and compared the performance of our solution to state-of-the-art methods, including non-time-oriented (classic ML algorithms) and order-based methods (LSTM networks). The results show that our proposed solution outperforms the other methods, obtaining 99.6% detection accuracy for unknown malware and 97.65% categorization accuracy. In a more complex scenario of detecting an unknown malware type with unseen modus operandi, our method obtained almost 90% detection accuracy, outperforming the state-of-the-art methods. To demonstrate our ability to provide human explainability, we present some temporal patterns of different malware families that we discovered which shed light on malware behavior that can be used by cyber-security experts to better understand malware, better defend against future attacks, and even attribute malware campaigns to the cyber-attackers launching them.

Uporedna pilot-analiza softverskih okruženja Kuku i Drakvuf za izolovano izvršavanje programa - perspektiva krajnjeg korisnika

Introduction/purpose: This paper reports on a pilot comparative analysis of the Cuckoo and Drakvuf sandboxes. These sandboxes are selected as the subjects of the analysis because of their popularity in the professional community and their complementary approaches to analyzing malware behavior. Methods: Both sandboxes were set up with basic configurations and confronted with the same set of malware samples. The evaluation was primarily conducted with respect to the question of to what extent a sandbox is helpful to the human analyst in malware analysis. Thus, only the information available in Web console reports was considered. Results: Drakvuf is expected to perform better when confronted with evasive malware and so-called "file-less" malware. Although still not mature in terms of integration, customization and tools, this sandbox is considered a second generation sandbox because of its agentless design. On the other hand, the Cuckoo sandbox creates a better overall experience: it is supported through good documentation and strong professional community, better integrated with various tools, support more virtualization, operating system and sample types, and generates more informative reports. Even with a smaller capacity to prevent evasive malware, its Python 2 agent script makes it more powerful than Drakvuf. Conclusion: To achieve the optimal open-source sandbox-based protection, it is recommended to apply both the Cuckoo and Drakvuf sandboxes. In circumstances of limited resources, applying the Cuckoo sandbox is preferable, especially if exposure to malware deploying evading techniques is not frequently expected.

MODELS AND METHODS FOR DIAGNOSING ZERO-DAYTHREATS IN CYBERSPACE

The article is devoted to the development of models and methods for detectingZero-Daythreats in cyberspace to improve the efficiency of detecting high-level malicious complexes that are using polymorphic mutators. Themethod for detecting samplesby antivirus solutions using a public and local multiscanneris proposed. Themethod for diagnosing polymorphic malware using Yara rules is being developed. The multicomponent service that allows organizing a free malware analysis solution with a hybrid deploy-ment architecture in public and private clouds is described. The cloud service for detecting malware based on open-source sandboxes and MAS, allowing horizontal scalability in hybrid clouds, and showing high capacity during malicious and non-maliciousobjectprocessing is designed. The main task of the service is to collect artifacts after dynamic and static object analysis to detect zero-daythreats. The effectiveness of the proposed solutions is shown.Scientific novelty and originality consist in the creation of the follow-ing methods:1) detecting the sample by preinstalled antivirus solutions that allow static scanning in separate threads without requests restrictions for increasing the malware processing speed and restrict public access to confidential files;2) diagnosing polymorphic malware using Yara rules, that allows detecting new modifications that are not detected by available solutions.The proposed hybrid system architecture allows to perform a retrospective search by families, tracking changes in destructive components, collect the malicious URLs database to block traffic to C&C servers, collect dropped and downloaded files, analyze phishing emails attach-ments, integrate with SIEM, IDS, IPS, antiphishing and Honeypot systems, improve the quality of the SOC analyst, decrease the incidents response times and block new threats that are not detected by available antivirus solutions. The practical significance of the results is in the cloud service development that combines MAS Sandbox and a modified distributed Cuckoo sandbox, which allows to respond to Zero-Day threats quickly, store a knowledge base for artifacts correlation between polymorphic malware samples, actively search for new malware samples and integrate with cyber protection hardwareand software systems that support the Cuckoo API.

Optimal feature configuration for dynamic malware detection

Applying machine learning techniques to malware detection is a common approach to try to overcome the limitations of signature-based methods. However, it is difficult to engineer a set of features that characterizes the samples properly, especially when various file types may be a vector of infection. In this work, we configure several feature sets for dynamic malware detection extracted from API calls, including an alternative scheme grouping calls in categories, network activity, signatures from the Cuckoo sandbox report, and some interactions with the file system and registry. We test combinations of these feature sets to ascertain whether they are good enough to distinguish between benign and malicious samples from a dataset containing several file types, obtained from public sources. We apply statistical inference to measure the differences in the performance between the feature sets, and the hyperparameter optimization algorithms applied to construct the models. We also unbalance the datasets to evaluate the model performance on more realistic scenarios in which not many malware samples are available. Although all studied feature configurations provide accuracies greater than 0.98, and several of them a Matthews correlation coefficient greater than 0.95 in the unbalanced datasets, statistically meaningful differences appear, so we analyze the results to determine which is the optimal set of features. We obtain a model that achieves an accuracy of 0.9937 in the balanced dataset and a Matthews correlation coefficient of 0.964 in the unbalanced dataset with 5% of malware.

A User-friendly Model for Ransomware Analysis Using Sandboxing

Ransomware is a type of malicious software that blocks access to a computer by encrypting user’s files until a ransom is paid to the attacker. There have been several reported high-profile ransomware attacks including WannaCry, Petya, and Bad Rabbit resulting in losses of over a billion dollars to various individuals and businesses in the world. The analysis of ransomware is often carried out via sandbox environments; however, the initial setup and configuration of such environments is a challenging task. Also, it is difficult for an ordinary computer user to correctly interpret the complex results presented in the reports generated by such environments and analysis tools. In this research work, we aim to develop a user-friendly model to understand the taxonomy and analysis of ransomware attacks. Also, we aim to present the results of analysis in the form of summarized reports that can easily be understood by an ordinary computer user. Our model is built on top of the well-known Cuckoo sandbox environment for identification of the ransomware as well as generation of the summarized reports. In addition, for evaluating the usability and accessibility of our proposed model, we conduct a comprehensive user survey consisting of participants from various fields, e.g., professional developers from software houses, people from academia (professors, students). Our evaluation results demonstrate a positive feedback of approximately 92% on the usability of our proposed model.

Investigating Anti-Evasion Malware Triggers Using Automated Sandbox Reconfiguration Techniques

Malware analysis is fundamental for defending against prevalent cyber security threats and requires a means to deploy and study behavioural software traits as more sophisticated malware is developed. Traditionally, virtual machines are used to provide an environment that is isolated from production systems so as to not cause any adverse impact on existing infrastructure. Malware developers are fully aware of this and so will often develop evasion techniques to avoid detection within sandbox environments. In this paper, we conduct an investigation of anti-evasion malware triggers for uncovering malware that may attempt to conceal itself when deployed in a traditional sandbox environment. To facilitate our investigation, we developed a tool called MORRIGU that couples together both automated and human-driven analysis for systematic testing of anti-evasion methods using dynamic sandbox reconfiguration techniques. This is further supported by visualisation methods for performing comparative analysis of system activity when malware is deployed under different sandbox configurations. Our study reveals a variety of anti-evasion traits that are shared amongst different malware families, such as sandbox “wear-and-tear”, and Reverse Turing Tests (RTT), as well as more sophisticated malware samples that require multiple anti-evasion checks to be deployed. We also perform a comparative study using Cuckoo sandbox to demonstrate the limitations of adopting only automated analysis tools, to justify the exploratory analysis provided by MORRIGU. By adopting a clearer systematic process for uncovering anti-evasion malware triggers, as supported by tools like MORRIGU, this study helps to further the research of evasive malware analysis so that we can better defend against such future attacks.

A Method for Windows Malware Detection Based on Deep Learning

As the Internet rapidly develops, the types and quantity of malware continue to diversify and increase, and the technology of evading security software is becoming more and more advanced. This paper proposes a malware detection method based on deep learning, which combines malware visualization technology with convolutional neural network. The structure of neural network is based on VGG16 network. This paper proposes the hybrid visualization of malware, combining static and dynamic analysis. In hybrid visualization, we use the Cuckoo Sandbox to carry out dynamic analysis on the samples, convert the dynamic analysis results into a visualization image according to a designed algorithm, and train the neural network on static and hybrid visualization images. Finally, we test the performance of the malware detection method we propose, evaluating its effectiveness on detecting unknown malware.

On Detection and Prevention of Zero-Day Attack Using Cuckoo Sandbox in Software-Defined Networks

Networks attacker may identify the network vulnerability within less than one day; this kind of attack is known as zero-day attack. This undiscovered vulnerability by vendors empowers the attacker to affect or damage the network operation, because vendors have less than one day to fix this new exposed vulnerability. The existing defense mechanisms against the zero-day attacks focus on the prevention effort, in which unknown or new vulnerabilities typically cannot be detected. To the best of our knowledge the protection mechanism against zero-day attack is not widely investigated for Software-Defined Networks (SDNs). Thus, in this work we are motivated to develop a new zero-day attack detection and prevention mechanism for SDNs by modifying Cuckoo sandbox tool. The mechanism is implemented and tested under UNIX system. The experiments results show that our proposed mechanism successfully stops the zero-day malwares by isolating the infected clients, in order to prevent the malwares from spreading to other clients. Moreover, results show the effectiveness of our mechanism in terms of detection accuracy and response time

Predicting the Dynamic Behaviour of Malware using RNN

Malware analysis can be classified as static and dynamic analysis. Static analysis involves the inspection of the malicious code by observing the features such as file signatures, strings etc. The code obfuscation techniques such as string encryption, class encryption etc can be easily applied on static code analysis. Dynamic or behavioural data is more difficult to obfuscate as the malicious payload may have already been executed before it is detected. In this paper, the dataset is obtained from repositories such as VirusShare and is run in Cuckoo Sandbox with the help of the agent.py. The dynamic features are extracted from the generated Cuckoo logs in the html and JSON format and it has to be determined whether it is malicious or not using recurrent neural networks. Recurrent Neural Networks are capable of predicting whether an executable is malicious and have the ability to capture time-series data.

Assessment of supervised machine learning algorithms using dynamic API calls for malware detection

ABSTRACT Detection of malware using traditional malware detection techniques is very hard. Machine Learning (ML) algorithms provide a solution to detect the malware which is being developed at a very high pace. ML automatic anti-malware system can be developed which can update the system with incoming malware to keep the system secure. To train the malware classifiers runtime features are captured through Cuckoo Sandbox. During execution, malware can drop other malicious payloads and every payload performs different malicious activities. API calls of every process executed by malware or benign file are extracted. In this paper, parameter tuning of Machine Learning (ML) is done to produce the high accuracy results in a binary classification of binary files into malware or benign. In machine learning algorithms, a few essential parameters like k value, kernel function, depth of the tree, loss function, splitting criteria, learning rate, and n-estimators are evaluated using API calls for achieving the high accurate results of the malware classifiers. At last, supervised machine learning classification algorithms were assessed with 6434 benign and 8634 malware samples. Malware classifier produced 99.1% accuracy using ensemble algorithms. This paper provides insight into the parameter tuning of ML algorithms for detecting the malware using API calls.

Transforming Malware Behavioural Dataset for Deep Denoising Autoencoders

This research is a part of a major research on automation of malware identification using Deep Denoising Autoencoders. Malicious software, or in short called malware refers to any software designed to cause damage to a single computer, server, or computer network. This malware term includes all kind of malicious software such as computer virus and spyware. All these malicious malware behaviour is monitored, logged and recorded using a cuckoo sandbox with the help of an x86 hosted supervisor software. The intent of recording the malware behaviour is to understand the pattern of behaviour of each known malware family. This collected data will be further trained to a Deep Denoising Autoencoders to automate the identification process of new malware within the identified malware families. However, the raw behaviour data is not suitable for an optimum training process. This paper will discuss the process of transforming the text based behavioural dataset to a more suitable dataset for deep learning purposes. At the end of the research a cleaned bit string format that should represent a unique malware behaviour will be produced.