Detection of Malicious Tools by Monitoring DLL Using Deep Learning

Abstract

In targeted attacks, various malicious tools are leveraged by attackers. According to the Cybersecurity and Infrastructure Security Agency (CISA), tools such as China Chopper, Mimikatz, PowerShell Empire, and HUC Packet Transmitter are used in targeted attacks. Standard malware detection methods include those based on file names or hashes. However, attackers tend to avoid detection by changing the file name of malicious tools or by rebuilding them. Therefore, detecting malicious tools used in targeted attacks is difficult. We found that the order of Windows built-in DLLs loaded by each malicious tool has unique characteristics. In this study, we propose a detection method of malicious tools by analyzing DLL information using deep learning, considering the DLL and its order of loading by each process. We confirmed that even if the file names are changed or tools are rebuilt, our proposed method could detect the mentioned four tools with high detection rates: with a recall rate of 97.45%, a precision rate of 97.29%, and F value of 97.37% on average. Furthermore, the proposed method can detect malicious tools with more than a 90% detection rate, even if about 10% of loaded DLLs are changed in the future.

Predicting and Visualizing Lateral Movements Based on ATT&CK and Quantification Theory Type 3

“…By collecting events generated via Windows Event Collection or SIEM agents and analyzing them, it's possible to identify malicious or anomalous activities, including lateral movement. Matsuda et al (2019Matsuda et al ( , 2020 proposed a real-time detection system for targeted attacks based on Window Sysmon logs (Microsoft, 2022) to obtain DLL information. Their later research achieved a high detection rate of 90% even if the DLL was changed by about 10% using deep learning analysis.…”

Detection and Blocking Method against DLL Injection Attack Using PEB-LDR of ICS EWS in Smart IoT Environments

“…Ha et al (2018) conducted a study to block the execution of malicious DLLs by learning API statistics for malicious DLLs [21]. In addition, Matsuda et al (2020) investigated various methods based on DLL data and proved a recall result of 97.45% for the malware detection rate using a deep learning algorithm [22]. This technique is highly accurate because it detects based on linear algebra values such as statistical estimation and regression analysis based on machine learning.…”