Attribution classification method of APT malware based on multi-feature fusion.

Area of Science:

• Cybersecurity
• Malware Analysis
• Machine Learning

Background:

• Attribution classification of advanced persistent threat (APT) malware is crucial due to internet development.
• Existing methods overlook DLL link libraries, hidden file addresses, and struggle with local/global event behavior correlations.
• Single features like binary structure or opcodes are susceptible to obfuscation and fail to capture reused behaviors within APT groups.

Purpose of the Study:

• To develop a robust APT malware attribution classification method.
• To address limitations in existing methods regarding feature extraction and correlation analysis.
• To improve the accuracy and reliability of malware attribution.

Main Methods:

• Constructed an event behavior graph using API instructions and operations to capture host execution traces via Graph Neural Networks (GNNs).
• Employed Image Convolutional Neural Network (ImageCNTM) to capture local spatial correlations and long-term dependencies in opcode images.
• Proposed a multi-feature, multi-input deep learning model by concatenating and fusing word frequency and behavior features.

Main Results:

• Single-feature classifiers achieved attribution classification rates of 89.24% and 91.91%.
• The multi-feature fusion model demonstrated superior classification performance compared to single-feature approaches.
• The proposed model effectively captures both local and global correlations in event behaviors.

Conclusions:

• Multi-feature fusion significantly enhances APT malware attribution classification accuracy.
• The developed deep learning model offers a more comprehensive approach by integrating diverse behavioral and structural features.
• This method provides a more resilient solution against obfuscation techniques impacting single-feature classifiers.