Defending our cyberspace: AI-powered search engine for cyber threat intelligence

点击翻译按钮获取中文摘要

The Internet and many online information systems have become part of the critical infrastructures of Canada. However, statistics show that Canadians - individuals, industry, and government - are not well-prepared for new waves of cyber threats. Malware is the crux of many cyberattacks, especially attacks on critical cyber(-physical) infrastructures such as power grids, financial institutions, healthcare, and transportation systems, etc. Reverse engineering is often the primary step taken to gain an in-depth understanding of a piece of malware before taking appropriate action to secure a critical infrastructure, but the manual process is often very time-consuming. There is a pressing need for effective reverse engineering tools to support large-scale malware analysis in order to provide an efficient and effective response to a cyberattack. The challenge is how to transform the ever-growing volume and complexity of collected software binaries into interpretable knowledge. This collaborative project brings together the expertise of AI, data mining, and cybersecurity from McGill University, Queen's University, Defence Research & Development Canada (DRDC), and a Canadian multinational company specializing in cybersecurity. The proposed project has two goals. The first is to enhance the capability of cybersecurity professionals on deep learning for large-scale malware analysis and to provide them a new generation of AI-powered reverse engineering methods and tools to efficiently understand the inner workings of malware. The second goal is to train a new cohort of cybersecurity professionals equipped with research capability and the latest hands-on AI skill set. The novelty of the proposed project is to turn the petabyte-scale binary files into an opportunity of learning semantic-enriched representations of assembly code via deep learning. The new tools will significantly improve the capability and efficiency of frontline reverse engineers to understand the behaviour of malware.