Classifying Advanced Malware into Families based on Instruction Link Analysis - project name: RAPTOR

点击翻译按钮获取中文摘要

Cyber-attacks can cause significant loss of business intelligence and intellectual property, damage to brand reputation and loss of money. The incidence and evolving technical complexity of malware is increasing, and the upsurge of Cybercrime as a Service means less skilled cyber-criminals can buy malware bundles to launch sophisticated attacks and shift into cyberwarfare.It is not just the reputational damage and the material cost that is impacted by cybercrime. There is an impact on public safety and the quality of life to the public when services such as the NHS are not available. Recently, a new ransomware variant called Ekans has been discovered targeting critical infrastructure. For these systems, which include power generation, water treatment, and hospitals, loss of productivity associated with a ransomware attack can have a devastating impact.Better malware detection means better protection for end-users. Cyber Security is one of the UK government's strategic priorities, and they have stated that addressing this challenge would have stopped attacks such as WannaCry, following a government report that estimated the ransomware virus caused approximately £19m of lost output and £73m in IT costs to the NHS. Experts have warned that 900 people a year may be dying because of weak NHS computer systems.RAPTOR seeks to bolster and enhance these systems' current malicious program practices.The difficulty in identifying and attributing malware poses a significant global risk. Harnessing Artificial Intelligence and Machine Learning, RAPTOR will explore how we can improve both current and future protection from persistent malware and advanced persistent threat (APT) attacks, to create a system that continuously improves detection rates as it is exposed to more data and malware.This innovation focuses on APT models, the most challenging area of detection and attribution. The ability to use Machine Learning models and algorithms to discern patterns and perform feature extraction relevant to the origin of the malware code is a significant advancement in the development of robust analytical and informative models.RAPTOR will positively disrupt the malware analysis market, by extending the abilities of systems that are already in place thus protecting against the growing threat of persistent cybercrime to businesses, governments, and citizens and supporting research institutions to better understand how persistent malware behaves.This will position the UK as leaders in malware analysis and research, bolstering our global reputation in the field of cybersecurity.