A novel intelligent cognitive computing-based APT malware detection for Endpoint systems

Abstract

Detecting and warning Advanced Persistent Threat (APT) malware in Endpoint is essential because the current trend of APT attacker groups is to find ways to spread malware to users and then escalate privileges in the system. In this study, to improve the ability to detect APT malware on Endpoint machines, we propose a novel intelligent cognitive calculation method based on a model combining graph embeddings and Attention using processes generated by executable files. The proposed intelligent cognitive computation method performs 3 main tasks: i) extracting behaviors of processes; ii) aggregating the malware behaviors based on the processes; iii) detecting APT malware based on behavior analysis. To carry out the task (i), we propose to use several data mining techniques: extracting processes from Event IDs in the operating system kernel; extracting abnormal behaviors of processes. For task (ii), a graph embedding (GE) model based on the Graph Convolutional Networks (GCN) network is proposed to be used. For task (iii), based on the results of task (ii), the paper proposes to use a combination of the Convolutional Neural Network (CNN) network and Attention network (called CNN-Attention). The novelty and originality of this study is an intelligent cognitive computation method based on the use, combination, and synchronization of many different data mining techniques to compute, extract, and represent relationships and correlations among APT malware behaviors from processes. Based on this new intelligent cognitive computation method, many meaningful anomalous features and behaviors of APT malware have been synthesized and extracted. The proposals related to data mining methods to extract malware’s features and the list of malware’s behaviors provided in this paper are new information that has not been published in previous studies. In the experimental section, to demonstrate the effectiveness of the proposed method in detecting APT malware, the study has compared and evaluated it with other approaches. Experimental results in the paper have shown the outstanding efficiency of the proposed method when ensuring all metrics from 96.6% or more (that are 2% to 6% higher than other approaches). Experimental results in the paper have proven that our proposed method not only has scientifically significant but also has practical meaning because the method has helped to improve the efficiency of analyzing and detecting APT malware on Endpoint devices. In addition, this research result also has opened up a new approach for the task of detecting other anomalies on the Endpoint such as malware, unauthorized intrusion, insider, etc.

A systematic literature review for APT detection and Effective Cyber Situational Awareness (ECSA) conceptual model

“…However, ML-based detection models have some quality issues, such as computational cost, accuracy, and time. Some studies used deep learning–based detection models to deal with massive amounts of data that required considerable storage and time for decision-making, such as [ 71 , 75 , 82 , 90 , 91 , 98 , 104 , 105 , 108 , 123 , 124 , 126 , [128] , [129] , [130] ]. Some studies that used AI-based detection models had problems such as delay, reliability, and computational costs, such as [ 70 , 72 , 74 , 77 , 79 , 122 , 131 , 132 ].…”

“…Xuan and Huong [ 124 ] proposed a method to analyse and evaluate behaviour profiles using the Graph Isomorphism Network (GIN) to improve the efficiency of analysing and detecting APT malware on workstations. In addition, Xuan et al [ 129 ] proposed a new method for analysing and detecting APT malware on endpoint devices, such as unauthorised intrusions and insiders, using CNN-attention, a combination of CNN and the attention network. Further, Xuan and Duong [ 130 ] proposed a model that improves analysis efficiency and APT malware detection based on network traffic using CNN-LSTM and the attention network.…”

Vulnerability detection under poisoning attacks through code and token features

“…In some cases metrics like the code's entropy, number of characters, number of conditional sentences, among others, are applied [20], [28]. Other works also play with cyclomatic complexity [9], [20], use dependency and control flow graphs [10], [22], [24], [25], [27], [30]- [34], even work at token level [23], use vectors to represent assorted information [8], [19], [21], [26] or directly apply the code [29]. Once features are extracted, machine learning algorithms are used in all cases, being neural networks the most common one, specially MLP, though some works also use DNN, like [29].…”

A novel approach for APT attack detection based on feature intelligent extraction and representation learning

“…With this proposal, the authors improved some shortcomings of the proposal [ 25 ]. With the same approach of using the Attention network to build behavior profiles of APT attacks, in the study [ 33 ], the authors proposed a model combining deep learning networks with Attention networks to classify APT malware. However, we found that this model was still relatively complicated and cumbersome, and was difficult to implement in practice.…”