End-to-End Deep Neural Networks and Transfer Learning for Automatic Analysis of Nation-State Malware.

Area of Science:

• Cybersecurity
• Machine Learning
• National Security

Background:

• Nation-state developed malware, known as advanced persistent threats (APTs), are increasingly prevalent.
• Attributing APTs to specific nation-states or families is challenging due to multiple development units, limited datasets, and sophisticated evasion techniques.

Purpose of the Study:

• To develop a deep neural network (DNN) model for classifying and attributing nation-state APTs.
• To leverage dynamic behavior analysis for feature extraction in APT classification.

Main Methods:

• Recorded dynamic behavior of APTs within a sandbox environment.
• Utilized raw behavioral data as input for a DNN classifier.
• Employed learned feature abstractions from APT family classification to aid in nation-state attribution.

Main Results:

• Achieved a 98.6% accuracy rate on a test set of 1000 Chinese and Russian developed APTs.
• Demonstrated the effectiveness of DNNs in learning high-level feature abstractions from raw APT behavior.

Conclusions:

• Deep neural networks offer a promising solution for the complex task of APT attribution and family classification.
• Dynamic behavior analysis combined with DNNs can overcome limitations of traditional attribution methods.