RAPID: AI-driven Innovations for COVID-19 Themed Malware Detection

新型冠状病毒病（COVID-19）的快速演变和致命爆发给人类社会带来了巨大挑战。在抗击全球大流行的斗争中，许多社交活动都转移到了网上。社会对复杂的网络空间前所未有的依赖使其安全比以往任何时候都更加重要。不幸的是，利用恐惧和经济激励，网络威胁行为者正在利用COVID-19或冠状病毒作为各种复杂的诱饵，传播恶意软件（即故意向合法用户实现有害意图的软件），以从大流行中获利。以COVID-19为主题的恶意软件（例如covid - lock， COVID-19银行木马）通过使用各种策略欺骗防御者并绕过其检测，变得越来越复杂和有弹性。这表明迫切需要创新技术来应对日益复杂的以COVID-19为主题的恶意软件的指数级增长，以便在网络空间中更好地保护用户。通过提高人工智能（AI）的能力，该项目的目标是在人工智能与安全之间建立创新联系，设计和开发以COVID-19为主题的恶意软件检测的综合框架，以帮助减轻其对公共卫生、社会和经济的负面影响。这个项目的成果（包括开源代码和生成的基准）将会公开。该项目通过创新课程开发、学生辅导活动和扩大代表性不足群体的参与，将研究与教育结合起来。这项研究有三个关键组成部分。首先，除了使用基于内容的功能外，该项目还将开发一种新的异构信息网络，以全面的方式表征和表示新生态系统中的应用程序及其复杂的社会关系。其次，该团队将开发一种创新的对抗性解纠结器，以分离隐藏在应用程序表示中的独特的、信息丰富的变化因素，这些变化是大规模COVID-19主题恶意软件检测所需的。第三，该团队将设计和开发一个基于深度学习的分类器，增强可解释性，以检测和理解恶意软件的传播方式。了解恶意软件传播方式的开发框架将有助于对冠状病毒传播的预测性理解。通过提供以COVID-19为主题的恶意软件检测系统，减少用户的精神痛苦和经济损失，计划中的工作将有助于减轻COVID-19对公共卫生，社会和经济的负面影响。建议的研究将有利于多学科领域，包括网络钓鱼欺诈检测，垃圾邮件过滤，以及涉及多个数据源的其他领域，如数据挖掘和机器学习。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The fast evolving and deadly outbreak of coronavirus disease (COVID-19) has posed grand challenges to human society. In the fight against the global pandemic, many social activities have moved online. Society's unprecedented reliance on the complex cyberspace makes its security more important than ever. Unfortunately, utilizing both fear and financial incentives, cyber threat actors are using COVID-19 or coronavirus as a lure all over the spectrum of sophistication to spread malware (i.e., software that deliberately fulfills the harmful intent to legitimate users) to gain profits from the pandemic. The malware with a COVID-19 theme (e.g., CovidLock, COVID-19 Banking Trojans) have become more and more sophisticated and resilient by using various tactics to fool the defenders and bypass their detection. This points to an imminent need for innovative techniques to combat the exponential growth of increasingly sophisticated COVID-19 themed malware so that users can be better protected in the cyberspace. By advancing capabilities of artificial intelligence (AI), the goal of this project is to develop innovative links between AI and security to design and develop an integrated framework for COVID-19 themed malware detection to help mitigate its negative effects on public health, society, and the economy. The outcomes of this project (including open-source codes and generated benchmarks) will be made publicly available. The project integrates research with education through innovative curriculum development, student mentoring activities, and broadening participation of underrepresented groups.The research has three key components. First, in addition to using content-based features, the project will develop a novel heterogeneous information network to characterize and represent applications (apps) and their complex social relations within the new ecosystem in a comprehensive manner. Second, the team will develop an innovative adversarial disentangler to separate the distinct, informative factors of variations hidden in the app representations needed for large-scale COVID-19 themed malware detection. Third, the team will design and develop a deep learning based classifier with interpretability enhancement for the detection and understanding of how malware spread. The developed framework for the understanding of how malware spread will facilitate a predictive understanding of the spread of coronavirus. By providing the system for COVID-19 themed malware detection to reduce mental anguish and financial loss for users, the planned work will help mitigate the negative effects of COVID-19 on public health, society, and the economy. The proposed research will be beneficial to multidisciplinary areas, including phishing fraud detection, spam filtering, and other domains such as data mining and machine learning where multiple data sources are involved.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.