Classifying Advanced Malware into Families based on Instruction Link Analysis - project name: RAPTOR

网络攻击会造成商业情报和知识产权的重大损失，损害品牌声誉和金钱损失。恶意软件的发生率和技术复杂性都在不断增加，网络犯罪即服务的兴起意味着技术不熟练的网络犯罪分子可以购买恶意软件包来发动复杂的攻击，并转向网络战。受网络犯罪影响的不仅仅是名誉损失和物质成本。当NHS等服务无法提供时，会对公共安全和公众的生活质量产生影响。最近，一种名为Ekans的新型勒索软件被发现针对关键基础设施。对于包括发电、水处理和医院在内的这些系统来说，勒索软件攻击造成的生产力损失可能会造成毁灭性的影响。更好的恶意软件检测意味着对终端用户更好的保护。网络安全是英国政府的战略重点之一，他们表示，解决这一挑战将阻止像“想哭”这样的攻击，此前一份政府报告估计，这种勒索病毒造成了约1900万英镑的产出损失，并给英国国家医疗服务体系（NHS）造成了7300万英镑的IT成本。专家警告说，每年可能有900人因为NHS计算机系统的薄弱而死亡。RAPTOR旨在支持和增强这些系统当前的恶意程序实践。识别和归因恶意软件的困难构成了重大的全球风险。利用人工智能和机器学习，RAPTOR将探索如何改进当前和未来的防护措施，防止持续恶意软件和高级持续性威胁（APT）攻击，创建一个在暴露于更多数据和恶意软件时不断提高检测率的系统。这项创新主要集中在APT模型上，这是检测和归因中最具挑战性的领域。使用机器学习模型和算法来识别模式并执行与恶意软件代码起源相关的特征提取的能力是开发健壮的分析和信息模型的重大进步。RAPTOR将积极地颠覆恶意软件分析市场，通过扩展现有系统的能力，从而抵御持续不断的网络犯罪对企业、政府和公民的威胁，并支持研究机构更好地了解持续恶意软件的行为。这将使英国成为恶意软件分析和研究的领导者，巩固我们在网络安全领域的全球声誉。

Cyber-attacks can cause significant loss of business intelligence and intellectual property, damage to brand reputation and loss of money. The incidence and evolving technical complexity of malware is increasing, and the upsurge of Cybercrime as a Service means less skilled cyber-criminals can buy malware bundles to launch sophisticated attacks and shift into cyberwarfare.It is not just the reputational damage and the material cost that is impacted by cybercrime. There is an impact on public safety and the quality of life to the public when services such as the NHS are not available. Recently, a new ransomware variant called Ekans has been discovered targeting critical infrastructure. For these systems, which include power generation, water treatment, and hospitals, loss of productivity associated with a ransomware attack can have a devastating impact.Better malware detection means better protection for end-users. Cyber Security is one of the UK government's strategic priorities, and they have stated that addressing this challenge would have stopped attacks such as WannaCry, following a government report that estimated the ransomware virus caused approximately £19m of lost output and £73m in IT costs to the NHS. Experts have warned that 900 people a year may be dying because of weak NHS computer systems.RAPTOR seeks to bolster and enhance these systems' current malicious program practices.The difficulty in identifying and attributing malware poses a significant global risk. Harnessing Artificial Intelligence and Machine Learning, RAPTOR will explore how we can improve both current and future protection from persistent malware and advanced persistent threat (APT) attacks, to create a system that continuously improves detection rates as it is exposed to more data and malware.This innovation focuses on APT models, the most challenging area of detection and attribution. The ability to use Machine Learning models and algorithms to discern patterns and perform feature extraction relevant to the origin of the malware code is a significant advancement in the development of robust analytical and informative models.RAPTOR will positively disrupt the malware analysis market, by extending the abilities of systems that are already in place thus protecting against the growing threat of persistent cybercrime to businesses, governments, and citizens and supporting research institutions to better understand how persistent malware behaves.This will position the UK as leaders in malware analysis and research, bolstering our global reputation in the field of cybersecurity.