Tensor Text-Mining Methods for Malware Identification and Detection, Malware Dynamics Characterization, and Hosts Ranking
- Los Alamos National Lab. (LANL), Los Alamos, NM (United States)
Malware is one of the most persistent and costly cyber threats endangering reputation, confidentiality, integrity, and availability for organizations and national security. Consequently, many of the incident detection and prevention systems, and incident responders have begun to utilize machine learning as a helper in the fight against malware and other cyber threats. However, cyber defenders rely on interpretability and generalizability, yet the popular machine learning methods are black-box and often use traditional supervised solutions that do not generalize to novel malware. Therefore, there is a need to improve the existing solutions. At the same time, the majority of the prior research ignored essential evaluation criteria when reporting the results of their methods, which disables the safe reproducibility of the methods in a production environment. Tensor decomposition, on the other hand, enables interpretable unsupervised analysis of the large-scale data for the discovery of hidden patterns. Our findings, performed on real-world and large-scale experiments, show that tensor factorization-based methods yield performance results that surpasses or competes with existing supervised solutions with the added benefit of interpretability and generalizability. With the ability to analyze complex and large-scale data using tensors, we report results that reflect real-world production environments. We propose to develop new game- changing tools for malware identification and characterization that can trace malware evolution, rank the infected or malicious hosts, and streamline the work of incident response teams, malware analysts, and incident detection and prevention systems.
- Research Organization:
- Los Alamos National Laboratory (LANL), Los Alamos, NM (United States)
- Sponsoring Organization:
- USDOE National Nuclear Security Administration (NNSA); LDRD
- DOE Contract Number:
- 89233218CNA000001
- OSTI ID:
- 1826495
- Report Number(s):
- LA-UR-21-30256
- Country of Publication:
- United States
- Language:
- English
Similar Records
A Hybrid Anomaly Detection Approach for Obfuscated Malware
Malware analysis and recovery
Living-off-the-land Techniques Unlikely to Supplant Energy Sector-Focused OT-Specific Malware
Conference
·
Tue Sep 24 00:00:00 EDT 2024
·
OSTI ID:2522685
Malware analysis and recovery
Patent
·
Mon Feb 22 23:00:00 EST 2021
·
OSTI ID:1805551
Living-off-the-land Techniques Unlikely to Supplant Energy Sector-Focused OT-Specific Malware
Technical Report
·
Fri Aug 30 00:00:00 EDT 2024
·
OSTI ID:2440408