Classifying Advanced Malware into Families based on Instruction Link Analysis - project name: RAPTOR

根据指令链接分析将高级恶意软件分类 - 项目名称：RAPTOR

• 批准号: 84000
• 金额: $ 12.12万
• 依托单位: DIGITAL INTERRUPTION LIMITED
• 依托单位国家: 英国
• 项目类别: Collaborative R&D
• 财政年份: 2020
• 资助国家: 英国
• 起止时间: 2020 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=84000
• 关键词: Classifying; Advanced; Malware; into; Families

Cyber-attacks can cause significant loss of business intelligence and intellectual property, damage to brand reputation and loss of money. The incidence and evolving technical complexity of malware is increasing, and the upsurge of Cybercrime as a Service means less skilled cyber-criminals can buy malware bundles to launch sophisticated attacks and shift into cyberwarfare.It is not just the reputational damage and the material cost that is impacted by cybercrime. There is an impact on public safety and the quality of life to the public when services such as the NHS are not available. Recently, a new ransomware variant called Ekans has been discovered targeting critical infrastructure. For these systems, which include power generation, water treatment, and hospitals, loss of productivity associated with a ransomware attack can have a devastating impact.Better malware detection means better protection for end-users. Cyber Security is one of the UK government's strategic priorities, and they have stated that addressing this challenge would have stopped attacks such as WannaCry, following a government report that estimated the ransomware virus caused approximately £19m of lost output and £73m in IT costs to the NHS. Experts have warned that 900 people a year may be dying because of weak NHS computer systems.RAPTOR seeks to bolster and enhance these systems' current malicious program practices.The difficulty in identifying and attributing malware poses a significant global risk. Harnessing Artificial Intelligence and Machine Learning, RAPTOR will explore how we can improve both current and future protection from persistent malware and advanced persistent threat (APT) attacks, to create a system that continuously improves detection rates as it is exposed to more data and malware.This innovation focuses on APT models, the most challenging area of detection and attribution. The ability to use Machine Learning models and algorithms to discern patterns and perform feature extraction relevant to the origin of the malware code is a significant advancement in the development of robust analytical and informative models.RAPTOR will positively disrupt the malware analysis market, by extending the abilities of systems that are already in place thus protecting against the growing threat of persistent cybercrime to businesses, governments, and citizens and supporting research institutions to better understand how persistent malware behaves.This will position the UK as leaders in malware analysis and research, bolstering our global reputation in the field of cybersecurity.

网络攻击可能导致商业情报和知识产权的重大损失，品牌声誉受损和金钱损失。恶意软件的发生率和不断发展的技术复杂性正在增加，网络犯罪即服务的激增意味着技能较低的网络犯罪分子可以购买恶意软件包来发动复杂的攻击并转向网络战争。网络犯罪影响的不仅仅是声誉损失和物质成本。当没有国民保健服务等服务时，公众的安全和生活质量会受到影响。最近，一种名为Ekans的新勒索软件变体被发现针对关键基础设施。对于这些系统（包括发电、水处理和医院）来说，勒索软件攻击导致的生产力损失可能会造成毁灭性的影响。更好的恶意软件检测意味着为最终用户提供更好的保护。网络安全是英国政府的战略重点之一，他们表示，解决这一挑战将阻止像WannaCry这样的攻击，此前一份政府报告估计勒索病毒造成了约1900万英镑的产出损失和7300万英镑的IT成本。专家警告说，每年可能有900人因NHS计算机系统薄弱而死亡。RAPTOR试图加强和加强这些系统目前的恶意程序做法。识别和归因恶意软件的困难构成了重大的全球风险。利用人工智能和机器学习，RAPTOR将探索如何提高当前和未来对持久性恶意软件和高级持久性威胁（APT）攻击的防护能力，以创建一个系统，在暴露于更多数据和恶意软件时不断提高检测率。这项创新专注于APT模型，这是检测和归因中最具挑战性的领域。使用机器学习模型和算法来识别模式并执行与恶意软件代码来源相关的特征提取的能力是开发强大的分析和信息模型的一个重大进步。RAPTOR将通过扩展已经到位的系统的能力，从而保护企业，政府，这将使英国成为恶意软件分析和研究领域的领导者，从而巩固我们在网络安全领域的全球声誉。