Research Initiation Award: A GNN+BiMCLSTM Based Framework to Model, Predict, and Traceback Malware Strains

HBCU-UP的研究启动奖为STEM教师提供支持，以开展研究活动，进一步提高他们的研究能力和有效性，并帮助加强HBCU的研究和教学。亚拉巴马州立大学的这个项目将进行研究，旨在开发新的基于人工智能（AI）的集成模型，以自动检测Web应用程序逻辑漏洞，并保护网络空间免受不断发展的基于恶意软件的网络攻击。网络空间现在是我们国家经济的基础，对我们的国家安全至关重要。网络攻击所构成的威胁正在增长，这一举措代表了该机构的一个新的研究领域（基于人工智能的网络安全），HBCU在STEM中有超过92%的少数民族本科生代表不足。该项目将通过开发创新方法来改善教学和学习，将网络安全和安全软件开发方法纳入多个STEM学科的教学和本科研究项目，包括但不限于计算机科学，数学，生物学和生物医学工程，从而对STEM专业，他们的专业发展和保留产生更广泛的影响。该项目将扩大国家的网络安全劳动力，重点是来自少数群体的学生的参与。网络犯罪分子利用多态恶意软件通过更改二进制代码或脚本来避免防病毒保护。他们使用木马化的应用程序、工具和服务来传播高度隐蔽的恶意软件。规避型恶意软件需要一种高效、弹性和可扩展的恶意软件检测机制。需要现代化的数据处理和恶意软件防御解决方案。拟议研究的目标是开发一个基于AI的集成模型，以抵御当前和未来的规避恶意软件攻击。该项目的具体目标是：1）阐明影响安全和漏洞的因素，2）开发一种新的基于人工智能的模型，通过静态分析自动发现恶意软件，3）开发一种新的基于黑盒人工智能的模型，通过动态分析自动发现恶意软件菌株，4）开发一个网络安全测试平台，用于培训和评估网络安全操作，5）为研究人员提供网络安全数据集，6）通过本科生研究项目培训HBCU本科生网络安全，7）通过社区研讨会和外展活动提高公众网络安全意识。该项目的目标将通过两阶段（静态和动态分析）策略来实现，该策略结合了以下人工智能技术：图形神经网络（GNN），模糊/相似性哈希（SSDEEP）和双向质量保持长短期记忆（biMC-LSTM）深度学习网络。该项目的智力贡献将包括：1）两种新型的基于人工智能的黑盒模型，旨在打击恶意软件规避策略; 2）一种革命性的深度学习神经网络模型，称为双向MC-LSTM，它将帮助网络安全专家预测网络事件，并对过去的事件进行数字取证。3）一种使用图形深度神经网络（GNN）从非结构化事件记录中提取软件程序行为的方法。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

HBCU-UP’s Research Initiation Awards provide support for STEM faculty to pursue research activities to further their research capabilities and effectiveness and help enhance research and teaching at HBCUs. This project at Alabama State University will conduct research aimed at developing new integrated artificial intelligence (AI)-based models to automatically detect web application logic vulnerabilities and to protect cyberspace from ever-evolving evasive malware-based cyberattacks. Cyberspace is now a foundation of our nation's economy and vital to our national security. The threat posed by cyberattacks is growing and this this initiative represents a new research area (AI-based cybersecurity) at the institution, an HBCU with more than 92% underrepresented minority undergraduates in STEM. This project will improve teaching and learning through the development of innovative methods for incorporating cybersecurity and secure software development methodologies into teaching and undergraduate research projects across multiple STEM disciplines, including but not limited to Computer Science, Mathematics, Biology, and Biomedical Engineering, thus having a broader impact on the STEM majors, their professional development, and retention. This project will expand the nation's cyber security workforce, with a focus on engagement of students from minoritized groups.Cybercriminals utilize polymorphic malware to avoid antivirus protection by changing the binary code or script. They use trojanized apps, tools, and services to spread highly elusive malware. Evasive malware requires an efficient, resilient, and scalable malware detection mechanism. Modern data processing and malware defense solutions are needed. The goal of the proposed research is to develop an integrated AI-based model to defend against present and future evasive malware attacks. The specific aims of this project are to: 1) elucidate the factors that influence the security and vulnerabilities, 2) develop a new AI-based model for the automatic discovery of malwares through static analysis, 3) develop a new black-box AI-based model for the automatic discovery of malwares strains through dynamic analysis, 4) develop a cybersecurity testbed for training and evaluating cybersecurity operations, 5) providing cybersecurity datasets to researchers, 6) train HBCU undergraduate students in cybersecurity through undergraduate research projects, and 7) improve public cybersecurity awareness through community workshops and outreach events. The project goal will be achieved through a two-stage (static and dynamic analysis) strategy that combines the following AI techniques: graphical neural networks (GNN), fuzzy/similarity hashing (SSDEEP), and bidirectional Mass-Conserving Long Short-Term Memory (biMC-LSTM) deep-learning network. This project's intellectual contribution will consist of 1) two novel AI-based black-box models designed to combat malware evasion tactics, and 2) a revolutionary deep-learning neural network model called bidirectional MC-LSTM, which will help cybersecurity experts predict cyber occurrences and conduct digital forensics on past events, 3) a method for extracting software program behavior from unstructured event records using a graphical deep neural network (GNN). This will assist researchers in identifying similarities between malware families and preventing recurrence of similar events.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.