Using synthetic data and unsupervised learning methods for malware detection

点击翻译按钮获取中文摘要

The rise of destructive cyber capabilities such as malware poses an increasing threat to the public and private sector in the UK. In the coming years, the National Cyber Security Council anticipates that the proliferation and commercial availability of cyber capabilities will expand the cyber security threat to the UK. In the future, malicious and disruptive cyber tools will be available to a wider range of state and non-state actors and will be deployed with greater frequency and with less predictability. In order to defend against the influx of new malware variants and increasingly sophisticated attacks, it is imperative to develop systematic mechanisms to detect them. We plan to develop a "vaccine" type approach using a controlled environment to understanding the spread of malware. This approach will simulate the complex nature of the data and then develop tools based innovative data analytic methodologies to try to detect the signature of malware attacks. This process will involve extensive interaction with domain experts to validate and refine the techniques. We believe that this process of end user co-creation and engagement could lead to wide deployment.