Research on APT groups malware classification based on TCN-GAN.

Area of Science:

• Cybersecurity
• Malware Analysis
• Machine Learning

Background:

• Advanced Persistent Threat (APT) malware poses significant risks to large organizations due to its stealth and destructiveness.
• Identifying APT malware sources is crucial for effective cybersecurity defense and attribution.
• Existing methods struggle with limited samples and data imbalance in APT malware classification.

Purpose of the Study:

• To develop an accurate method for tracing and attributing Advanced Persistent Threat (APT) malware groups.
• To improve the classification and identification of APT malware by enhancing feature extraction and employing advanced machine learning models.
• To address the challenges of insufficient sample size and data imbalance in APT malware analysis.

Main Methods:

• Innovative extraction of image and disassembled instruction N-gram features from APT malware.
• Application of the Temporal Convolutional Network (TCN) model for malware classification.
• Utilizing Generative Adversarial Networks (GAN) to augment the APT malware sample dataset.

Main Results:

• Achieved a 99.8% accuracy and precision rate in identifying and classifying APT malware.
• Demonstrated superior performance compared to existing methods on public and self-constructed datasets.
• Successfully mitigated the impact of limited samples and data imbalance through GAN-based data augmentation.

Conclusions:

• The proposed method offers a highly accurate approach for APT malware attribution and identification.
• This research provides a robust foundation for developing effective countermeasures and accountability strategies against APT groups.
• The integration of TCN and GAN presents a promising direction for advanced malware analysis in cybersecurity.