Using synthetic data and unsupervised learning methods for malware detection

恶意软件等破坏性网络能力的崛起，对英国公共和私营部门构成了越来越大的威胁。在未来几年，国家网络安全委员会预计，网络能力的扩散和商业可用性将扩大对英国的网络安全威胁。未来，更广泛的国家和非国家行为体将可以使用恶意和破坏性的网络工具，并将以更高的频率和更低的可预测性进行部署。为了抵御新恶意软件变体的涌入和日益复杂的攻击，必须开发系统的机制来检测它们。我们计划开发一种“疫苗”类型的方法，使用受控环境来了解恶意软件的传播。这种方法将模拟数据的复杂性质，然后开发基于创新数据分析方法的工具，以尝试检测恶意软件攻击的特征。此过程将涉及与领域专家的广泛交互，以验证和改进技术。我们相信，这种终端用户共同创造和参与的过程可能会导致广泛的部署。

The rise of destructive cyber capabilities such as malware poses an increasing threat to the public and private sector in the UK. In the coming years, the National Cyber Security Council anticipates that the proliferation and commercial availability of cyber capabilities will expand the cyber security threat to the UK. In the future, malicious and disruptive cyber tools will be available to a wider range of state and non-state actors and will be deployed with greater frequency and with less predictability. In order to defend against the influx of new malware variants and increasingly sophisticated attacks, it is imperative to develop systematic mechanisms to detect them. We plan to develop a "vaccine" type approach using a controlled environment to understanding the spread of malware. This approach will simulate the complex nature of the data and then develop tools based innovative data analytic methodologies to try to detect the signature of malware attacks. This process will involve extensive interaction with domain experts to validate and refine the techniques. We believe that this process of end user co-creation and engagement could lead to wide deployment.