Heuristic Malware Detection Method Based on Structured CTI Data: A Research Study and Proposal

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F24%3A00139901" target="_blank" >RIV/00216224:14330/24:00139901 - isvavai.cz</a>
Result on the web
<a href="http://dx.doi.org/10.23919/SoftCOM62040.2024.10721992" target="_blank" >http://dx.doi.org/10.23919/SoftCOM62040.2024.10721992</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.23919/SoftCOM62040.2024.10721992" target="_blank" >10.23919/SoftCOM62040.2024.10721992</a>

Result language
angličtina
Original language name
Heuristic Malware Detection Method Based on Structured CTI Data: A Research Study and Proposal
Original language description
This article addresses the significant and evolving threat of malware, particularly ransomware, to critical infrastructure sectors such as energy, banking, and food supply. Traditional detection methods that rely on specific indicators of compromise, like file hashes or IP addresses, can be easily circumvented by attackers. This paper presents a novel heuristic approach to malware detection using structured cyber threat intelligence data. By aggregating high-level indicators of compromise such as file modifications, registry key changes, and suspicious network communications, this method aims to identify malicious patterns indicative of malware behavior. The proposed detection system employs advanced machine learning techniques, including graph neural networks, to analyze these aggregated indicators of compromise. This approach enables earlier detection of malware, reduces the mean time to detect breaches, and minimizes false positives. The system utilizes the STIX data format for improved interoperability and analysis of cyber threat intelligence data.
Czech name
—
Czech description
—

Project
<a href="/en/project/VK01030030" target="_blank" >VK01030030: Data backup and storage system with integrated active protection against cyber threats</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year
2024
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection
2024 International Conference on Software, Telecommunications and Computer Networks (SoftCOM)
ISBN
9798350354614
ISSN
—
e-ISSN
1847-358X
Number of pages
6
Pages from-to
380-385
Publisher name
IEEE
Place of publication
Croatia
Event location
Bol, Brac, Croatia
Event date
Jan 1, 2024
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—

Similar results(10)