TagSeq: Malicious behavior discovery using dynamic analysis.

Area of Science:

• Cybersecurity
• Machine Learning
• Malware Analysis

Background:

• Malware analysis increasingly relies on automated methods for classification and detection.
• High-level semantic descriptions of malware activity still heavily depend on manual analysis.
• Existing methods lack efficient automated labeling of malicious behaviors.

Purpose of the Study:

• To develop an automated system for labeling malware behavior using sequence-to-sequence neural networks.
• To investigate the effectiveness of embedding modules for Windows API call parameters, registry, filenames, and URLs.
• To enhance the identification of malicious intent through interpretable tags.

Main Methods:

• Development of a sequence-to-sequence (seq2seq) neural network named TagSeq.
• Implementation of embedding modules to convert API parameters, registry, filenames, and URLs into low-dimension vectors.
• Utilization of an attention mechanism to correlate generated tags with specific API calls.

Main Results:

• TagSeq successfully identifies probable malicious actions from malware execution traces.
• The proposed embedding modules preserve semantic-physical relations.
• Predicted tags accurately reflect the malicious intentions of the malware.

Conclusions:

• TagSeq offers an effective automated approach to labeling malware behavior.
• The system assists security analysts in understanding malware intent through easy-to-understand tags.
• This work contributes to more efficient and accurate malware analysis in cybersecurity.