Next Article in Journal
Maxwell’s Demon and the Problem of Observers in General Relativity
Next Article in Special Issue
A Novel Boolean Kernels Family for Categorical Data
Previous Article in Journal
Identification of Pulmonary Hypertension Using Entropy Measure Analysis of Heart Sound Signal
Previous Article in Special Issue
Transfer Information Energy: A Quantitative Indicator of Information Transfer between Time Series
Article Menu
Issue 5 (May) cover image

Export Article

Open AccessArticle
Entropy 2018, 20(5), 390; https://doi.org/10.3390/e20050390

End-to-End Deep Neural Networks and Transfer Learning for Automatic Analysis of Nation-State Malware

Deep Instinct Ltd., Tel Aviv 6618356, Israel
*
Authors to whom correspondence should be addressed.
Received: 1 March 2018 / Revised: 10 May 2018 / Accepted: 11 May 2018 / Published: 22 May 2018
Full-Text   |   PDF [333 KB, uploaded 22 May 2018]   |  

Abstract

Malware allegedly developed by nation-states, also known as advanced persistent threats (APT), are becoming more common. The task of attributing an APT to a specific nation-state or classifying it to the correct APT family is challenging for several reasons. First, each nation-state has more than a single cyber unit that develops such malware, rendering traditional authorship attribution algorithms useless. Furthermore, the dataset of such available APTs is still extremely small. Finally, those APTs use state-of-the-art evasion techniques, making feature extraction challenging. In this paper, we use a deep neural network (DNN) as a classifier for nation-state APT attribution. We record the dynamic behavior of the APT when run in a sandbox and use it as raw input for the neural network, allowing the DNN to learn high level feature abstractions of the APTs itself. We also use the same raw features for APT family classification. Finally, we use the feature abstractions learned by the APT family classifier to solve the attribution problem. Using a test set of 1000 Chinese and Russian developed APTs, we achieved an accuracy rate of 98.6% View Full-Text
Keywords: cybersecurity; attribution; nation-state APT; family classification; deep learning; transfer learning cybersecurity; attribution; nation-state APT; family classification; deep learning; transfer learning
Figures

Figure 1

This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited (CC BY 4.0).
SciFeed

Share & Cite This Article

MDPI and ACS Style

Rosenberg, I.; Sicard, G.; David, E.O. End-to-End Deep Neural Networks and Transfer Learning for Automatic Analysis of Nation-State Malware. Entropy 2018, 20, 390.

Show more citation formats Show less citations formats

Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.

Related Articles

Article Metrics

Article Access Statistics

1

Comments

[Return to top]
Entropy EISSN 1099-4300 Published by MDPI AG, Basel, Switzerland RSS E-Mail Table of Contents Alert
Back to Top