Malware Repositories Research Articles

Malware Detection with Artificial Intelligence: A Systematic Literature Review

In this survey, we review the key developments in the field of malware detection using AI and analyze core challenges. We systematically survey state-of-the-art methods across five critical aspects of building an accurate and robust AI-powered malware-detection model: malware sophistication, analysis techniques, malware repositories, feature selection, and machine learning vs. deep learning. The effectiveness of an AI model is dependent on the quality of the features it is trained with. In turn, the quality and authenticity of these features is dependent on the quality of the dataset and the suitability of the analysis tool. Static analysis is fast but is limited by the widespread use of obfuscation. Dynamic analysis is not impacted by obfuscation but is defeated by ubiquitous anti-analysis techniques and requires more computational power. Sophisticated and evasive malware is challenging to extract authentic discriminatory features from and, combined with poor quality datasets, this can lead to a situation where a model achieves high accuracy with only one specific dataset.

HackerScope: the dynamics of a massive hacker online ecosystem

One would have thought that hackers would be striving to hide from public view, but we find that this is not the case: they have a public online footprint. Apart from online security forums, this footprint appears also in software development platforms, where authors create publicly accessible malware repositories to share and collaborate. With the exception of a few recent efforts, the existence and the dynamics of this community has received surprisingly limited attention. The goal of our work is to analyze this ecosystem of hackers in order to: (a) understand their collaborative patterns and (b) identify and profile its most influential authors. We develop HackerScope, a systematic approach for analyzing the dynamics of this hacker ecosystem. Leveraging our targeted data collection, we conduct an extensive study of 7389 authors of malware repositories on GitHub, which we combine with their activity on four security forums. From a modelling point of view, we study the ecosystem using three network representations: (a) the author-author network, (b) the author-repository network and (c) cross-platform egonets. Our analysis leads to the following key observations: (a) the ecosystem is growing at an accelerating rate as the number of new malware authors per year triples every 2 years, (b) it is highly collaborative, more so than the rest of GitHub authors, and (c) it includes influential and professional hackers. We find 101 authors maintain an online “brand” across GitHub and our online forums. Our study is a significant step towards using public online information for understanding the malicious hacker community.

Automated Dataset Generation System for Collaborative Research of Cyber Threat Analysis

The objectives of cyberattacks are becoming sophisticated, and attackers are concealing their identity by masquerading as other attackers. Cyber threat intelligence (CTI) is gaining attention as a way to collect meaningful knowledge to better understand the intention of an attacker and eventually predict future attacks. A systemic threat analysis based on data acquired from actual cyber incidents is a useful approach to generating intelligence for such an objective. Developing an analysis technique requires a high-volume and fine-quality data. However, researchers can become discouraged by inaccessibility to data because organizations rarely release their data to the research community. Owing to a data inaccessibility issue, academic research tends to be biased toward techniques that develop steps of the CTI process other than analysis and production. In this paper, we propose an automated dataset generation system called CTIMiner. The system collects threat data from publicly available security reports and malware repositories. The data are stored in a structured format. We released the source codes and dataset to the public, including approximately 640,000 records from 612 security reports published from January 2008 to June 2019. In addition, we present a statistical feature of the dataset and techniques that can be developed using it. Moreover, we demonstrate an application example of the dataset that analyzes the correlation and characteristics of an incident. We believe our dataset will promote collaborative research on threat analysis for the generation of CTI.

Anatomy of ransomware malware: detection, analysis and reporting

Rapidly increasing malware samples pose a serious threat to cyber security especially when they are not getting detected by security tools and techniques. Malware writers obfuscate the malware samples to conceal malicious code inside a legitimate executable to evade antivirus solutions and tamper it without changing its genuine structure to exploit target machines and remain fully undetected (FUD). Thus, it is a major challenge before Cyber Clean operations run by various government agencies to monitor malicious activities in their official network. Ransomware is a malware that encrypts documents to breach information on victim machine and asks for ransom to provide the decryption key. This paper presents the results of static and dynamic analysis of nine prominent variants of ransomware samples obtained from renowned malware repositories. A test bed is prepared to analyse these samples in Cuckoo's sandbox environment to monitor altered files/directories, tampered registry keys, Command and Control (C&C) and accessed application programming interfaces (APIs). At the end of this paper, we present the observations from our experimental analysis and provide remedial measures to deal with these samples, which would more likely impact the future analysis of ransomware.

Anatomy of ransomware malware: detection, analysis and reporting

Rapidly increasing malware samples pose a serious threat to cyber security especially when they are not getting detected by security tools and techniques. Malware writers obfuscate the malware samples to conceal malicious code inside a legitimate executable to evade antivirus solutions and tamper it without changing its genuine structure to exploit target machines and remain fully undetected (FUD). Thus, it is a major challenge before Cyber Clean operations run by various government agencies to monitor malicious activities in their official network. Ransomware is a malware that encrypts documents to breach information on victim machine and asks for ransom to provide the decryption key. This paper presents the results of static and dynamic analysis of nine prominent variants of ransomware samples obtained from renowned malware repositories. A test bed is prepared to analyse these samples in Cuckoo's sandbox environment to monitor altered files/directories, tampered registry keys, Command and Control (C&C) and accessed application programming interfaces (APIs). At the end of this paper, we present the observations from our experimental analysis and provide remedial measures to deal with these samples, which would more likely impact the future analysis of ransomware.