Defending our cyberspace: AI-powered search engine for cyber threat intelligence

互联网和许多在线信息系统已成为加拿大关键基础设施的一部分。然而，统计数据显示，加拿大人——个人、行业和政府——并没有为新一波的网络威胁做好充分准备。恶意软件是许多网络攻击的关键，尤其是对关键网络（物理）基础设施的攻击，如电网、金融机构、医疗保健和交通系统等。在采取适当措施保护关键基础设施之前，逆向工程通常是深入了解恶意软件的主要步骤，但是手动过程通常非常耗时。迫切需要有效的逆向工程工具来支持大规模恶意软件分析，以便对网络攻击提供高效和有效的响应。挑战在于如何将收集的软件二进制文件不断增长的数量和复杂性转化为可解释的知识。该合作项目汇集了麦吉尔大学、女王大学、加拿大国防研究与发展部（DRDC）和一家专门从事网络安全的加拿大跨国公司在人工智能、数据挖掘和网络安全方面的专业知识。拟议中的项目有两个目标。首先是增强网络安全专业人员对大规模恶意软件分析的深度学习能力，并为他们提供新一代人工智能驱动的逆向工程方法和工具，以有效地了解恶意软件的内部工作原理。第二个目标是培养一批具有研究能力和最新人工智能实践技能的新网络安全专业人员。该项目的新颖之处在于将pb级二进制文件转化为通过深度学习学习汇编代码的语义丰富表示的机会。新工具将显著提高一线逆向工程师理解恶意软件行为的能力和效率。

The Internet and many online information systems have become part of the critical infrastructures of Canada. However, statistics show that Canadians - individuals, industry, and government - are not well-prepared for new waves of cyber threats. Malware is the crux of many cyberattacks, especially attacks on critical cyber(-physical) infrastructures such as power grids, financial institutions, healthcare, and transportation systems, etc. Reverse engineering is often the primary step taken to gain an in-depth understanding of a piece of malware before taking appropriate action to secure a critical infrastructure, but the manual process is often very time-consuming. There is a pressing need for effective reverse engineering tools to support large-scale malware analysis in order to provide an efficient and effective response to a cyberattack. The challenge is how to transform the ever-growing volume and complexity of collected software binaries into interpretable knowledge. This collaborative project brings together the expertise of AI, data mining, and cybersecurity from McGill University, Queen's University, Defence Research & Development Canada (DRDC), and a Canadian multinational company specializing in cybersecurity. The proposed project has two goals. The first is to enhance the capability of cybersecurity professionals on deep learning for large-scale malware analysis and to provide them a new generation of AI-powered reverse engineering methods and tools to efficiently understand the inner workings of malware. The second goal is to train a new cohort of cybersecurity professionals equipped with research capability and the latest hands-on AI skill set. The novelty of the proposed project is to turn the petabyte-scale binary files into an opportunity of learning semantic-enriched representations of assembly code via deep learning. The new tools will significantly improve the capability and efficiency of frontline reverse engineers to understand the behaviour of malware.