Research Initiation Award: A GNN+BiMCLSTM Based Framework to Model, Predict, and Traceback Malware Strains

HBCU-UP的研究启动奖为STEM教师开展研究活动提供支持，以进一步提高他们的研究能力和效率，并帮助提高hbcu的研究和教学水平。阿拉巴马州立大学的这个项目将进行研究，旨在开发新的基于集成人工智能（AI）的模型，以自动检测web应用程序逻辑漏洞，并保护网络空间免受不断发展的基于恶意软件的网络攻击。网络空间现在是我们国家经济的基础，对我们的国家安全至关重要。网络攻击带来的威胁正在增长，这一举措代表了该机构的一个新的研究领域（基于人工智能的网络安全），HBCU有超过92%的STEM少数族裔本科生。该项目将通过开发创新方法，将网络安全和安全软件开发方法纳入多个STEM学科（包括但不限于计算机科学、数学、生物学和生物医学工程）的教学和本科生研究项目，从而改善教学和学习，从而对STEM专业及其专业发展和保留产生更广泛的影响。该项目将扩大国家的网络安全劳动力，重点是少数群体学生的参与。网络犯罪分子利用多态恶意软件通过更改二进制代码或脚本来避免防病毒保护。他们使用木马化的应用程序、工具和服务来传播难以捉摸的恶意软件。规避型恶意软件需要一种高效、有弹性和可扩展的恶意软件检测机制。需要现代数据处理和恶意软件防御解决方案。提出的研究目标是开发一个集成的基于人工智能的模型，以防御当前和未来的规避性恶意软件攻击。该项目的具体目标是：1)阐明影响安全和漏洞的因素，2)通过静态分析开发新的基于人工智能的恶意软件自动发现模型，3)通过动态分析开发新的基于黑盒人工智能的恶意软件自动发现模型，4)开发用于培训和评估网络安全操作的网络安全测试平台，5)为研究人员提供网络安全数据集。6)通过本科生研究项目对HBCU本科生进行网络安全培训；7)通过社区研讨会和外展活动提高公众网络安全意识。该项目的目标将通过两阶段（静态和动态分析）策略来实现，该策略结合了以下人工智能技术：图形神经网络（GNN）、模糊/相似散列（SSDEEP）和双向质量守恒长短期记忆（biMC-LSTM）深度学习网络。该项目的智力贡献将包括：1)两个新的基于人工智能的黑箱模型，旨在打击恶意软件规避策略；2)一个革命性的深度学习神经网络模型，称为双向MC-LSTM，它将帮助网络安全专家预测网络事件并对过去的事件进行数字取证；3)一种使用图形深度神经网络（GNN）从非结构化事件记录中提取软件程序行为的方法。这将有助于研究人员识别恶意软件家族之间的相似性，并防止类似事件的再次发生。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

HBCU-UP’s Research Initiation Awards provide support for STEM faculty to pursue research activities to further their research capabilities and effectiveness and help enhance research and teaching at HBCUs. This project at Alabama State University will conduct research aimed at developing new integrated artificial intelligence (AI)-based models to automatically detect web application logic vulnerabilities and to protect cyberspace from ever-evolving evasive malware-based cyberattacks. Cyberspace is now a foundation of our nation's economy and vital to our national security. The threat posed by cyberattacks is growing and this this initiative represents a new research area (AI-based cybersecurity) at the institution, an HBCU with more than 92% underrepresented minority undergraduates in STEM. This project will improve teaching and learning through the development of innovative methods for incorporating cybersecurity and secure software development methodologies into teaching and undergraduate research projects across multiple STEM disciplines, including but not limited to Computer Science, Mathematics, Biology, and Biomedical Engineering, thus having a broader impact on the STEM majors, their professional development, and retention. This project will expand the nation's cyber security workforce, with a focus on engagement of students from minoritized groups.Cybercriminals utilize polymorphic malware to avoid antivirus protection by changing the binary code or script. They use trojanized apps, tools, and services to spread highly elusive malware. Evasive malware requires an efficient, resilient, and scalable malware detection mechanism. Modern data processing and malware defense solutions are needed. The goal of the proposed research is to develop an integrated AI-based model to defend against present and future evasive malware attacks. The specific aims of this project are to: 1) elucidate the factors that influence the security and vulnerabilities, 2) develop a new AI-based model for the automatic discovery of malwares through static analysis, 3) develop a new black-box AI-based model for the automatic discovery of malwares strains through dynamic analysis, 4) develop a cybersecurity testbed for training and evaluating cybersecurity operations, 5) providing cybersecurity datasets to researchers, 6) train HBCU undergraduate students in cybersecurity through undergraduate research projects, and 7) improve public cybersecurity awareness through community workshops and outreach events. The project goal will be achieved through a two-stage (static and dynamic analysis) strategy that combines the following AI techniques: graphical neural networks (GNN), fuzzy/similarity hashing (SSDEEP), and bidirectional Mass-Conserving Long Short-Term Memory (biMC-LSTM) deep-learning network. This project's intellectual contribution will consist of 1) two novel AI-based black-box models designed to combat malware evasion tactics, and 2) a revolutionary deep-learning neural network model called bidirectional MC-LSTM, which will help cybersecurity experts predict cyber occurrences and conduct digital forensics on past events, 3) a method for extracting software program behavior from unstructured event records using a graphical deep neural network (GNN). This will assist researchers in identifying similarities between malware families and preventing recurrence of similar events.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.