Advanced persistent threat organization identification based on software gene of malware

Abstract

Since the concept of IoT (Internet of Things) was proposed, it has digitized the real world and has a wide range of applications. However, with tremendous evolution in data acquisition and transfer, a new type of attack represented by advanced persistent threat (APT) has attracted wide attention. APT organization identification for malware is a method to detect APT attacks. However, most of malware is tailored to the goal, it is complex and changeable, or can be updated very quickly. The traditional analysis method is difficult to obtain the source information of APT organization from the malware in the IoT. To this end, we propose a software genes method to solve this problem. Software gene is binary fragment of specific function or information in the software body. In this paper, different from traditional data flow and instruction flow, a new gene model is proposed which combine with knowledge graph of malware behavior. We fill the processed malware information into the gene model to obtain the APT organization gene pool. Of course, the gene pool should be optimized to include the genetic characteristics of APT. In theory, there genetic characteristics can help us identify malware and APT accurately in the IoT. However, biological genetic similarity algorithms cannot be used directly. A genetic similarity algorithm for APT organization identification of malware will be designed instead. Simulations on real-world dataset corroborate theoretical analysis and reveal the possibility of using genes for malware traceability.

A systematic literature review for APT detection and Effective Cyber Situational Awareness (ECSA) conceptual model

“…Static analysis is a form of code analysis method that receives a software package's origin code or binary code as input [ 138 ] and then inspects the code without running the software package to ensure its security and reliability. When compared to dynamic analysis, static analysis does not need to execute the application, so it is efficient and fast.…”

Toward Identifying APT Malware through API System Calls

“…ey trained each isolation forest with specific APT samples using only static features. To solve the problem of malware APT organization identification, Chen et al [4] designed a gene model combined with the knowledge graph of malware behavior. ey proposed a genetic similarity algorithm for malware APT organization identification and revealed the possibility of using genes to trace malware.…”

“…However, unlike traditional network attacks, APT attacks will use some independent development malware to achieve specific purposes against different targets [3]. is malware is collectively called APT malware [4]. APT malware is one kind of advanced malware tailored for special targets, which has posed even more serious threats than the traditional malware [2].…”

Attribution Classification Method of APT Malware in IoT Using Machine Learning Techniques

“…Moreover, in 2016, hackers launched DDOS attacks by manipulating IoT devices infected with malware known as Mirai. Behind APT attacks, there are usually organizations with government background or intelligence institutional background that provide funding with political or economic purpose [5]; the threat to national and enterprise information security systems is becoming more and more serious, and the number of APT reports is increasing year by year. Security agencies of various countries have disclosed hundreds of APT organizations, commonly active ones being Russia's APT28 and APT29, North Korea's Lazarus, and so on.…”

“…e dynamic feature extraction is used to monitor the behavior of the program when it is running and then extract the dynamic behavior characteristics of the code such as API operations, file system operations, function access, and system calls. For example, Chen et al [5] proposed a new genetic model combined with a knowledge map of malware behavior.…”