Method for detecting core malware sites related to biomedical information systems

Area of Science:

• Cybersecurity
• Network analysis
• Biomedical informatics

Background:

• Advanced persistent threat (APT) attacks increasingly exploit web users via malicious code on exploit or distribution sites.
• Biomedical information systems are vulnerable to these sophisticated cyber threats, necessitating effective website blocking strategies.

Purpose of the Study:

• To present a novel method for locating and proactively eliminating malicious websites targeting biomedical information systems.
• To enhance the security of biomedical data by reducing the attack surface.

Main Methods:

• Utilizing malicious code crawling to analyze the centrality between malware sites.
• Calculating a dynamic risk index for websites by analyzing various centrality measures and creating a quantified vector.
• Identifying and eliminating core-hub nodes of malicious networks to proactively remove threats.

Main Results:

• The proposed method effectively identifies and prioritizes malicious websites based on their risk index.
• Proactive elimination of identified core malicious websites led to an average improvement of over 20% in zero-day attack detection.
• Reduced the need for extensive and potentially unnecessary security policies by targeting the root of the threat.

Conclusions:

• The developed approach offers an effective strategy for proactively defending biomedical information systems against advanced persistent threat attacks.
• By focusing on core malicious infrastructure, this method significantly enhances the detection of novel (zero-day) cyber threats.
• This research contributes to strengthening the cybersecurity posture of critical biomedical data infrastructure.