Abstract:In cybersecurity, adversaries employ a myriad of tactics to evade detection and breach defenses. Malware remains a formidable weapon in their arsenal. To counter this threat, researchers unceasingly pursue dynamic analysis, which aims to comprehend and thwart established malware strains. This paper introduces an innovative methodology for dynamic malware analysis while critically evaluating prevailing technologies and their limitations. The proposed approach hinges on harnessing the capabilities of an open-source Security Information and Event Management (SIEM) toolset, namely the Elastic-Stack. This toolset is utilized to capture, structure, and analyze the behavioral patterns of malware without relying on any pre-existing sandbox framework. This augmentation facilitates a profound understanding of the activities exhibited by malware samples. With the help of the proposed ecosystem, we compile the AAU_MalData dataset that encompasses distinctly the benign and malicious behavior. Specifically, we analyzed the behavior of the 2,800 malware within a realistic network topology and systematically collected Windows event logs, which serve as a comprehensive record of the malware's actions. These event logs are precious as they are organized in a timestamped format, providing a chronological list of system activities, such as event descriptions, process and file details, and registry modifications. These are pivotal in comprehending the malware's functionality and repercussions on the compromised system. Furthermore, by incorporating the MITRE ATT&CK framework, we leveraged the event logs to correlate the malware's mode of operation, delve into its Command and Control operations, and investigate its persistence mechanisms, enabling a structured and practical approach to malware analysis. The AAU_MalData dataset, organized in a JSON format data structure, is offered to the research community first as a proof of concept to demonstrate the toolset's feasibility for dynamic malware analysis and second as a potential training ground for anti-malware mechanisms based on host and network Indicators of Compromise (IoCs).

Detection Strategies for COM, WMI, and ALPC-Based Multi-Process Malware

A malware detection framework based on kolmogorov complexity

You Are What You Do: Hunting Stealthy Malware Via Data Provenance Analysis

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Adversarial Malware Examples for Terminal Cyberspace Attack Analysis in Cyber-Physical Power Systems

SLIFER: Investigating Performance and Robustness of Malware Detection Pipelines

Comprehensive Botnet Detection by Mitigating Adversarial Attacks, Navigating the Subtleties of Perturbation Distances and Fortifying Predictions with Conformal Layers

Tutorial: An Overview of Malware Detection and Evasion Techniques

Burning the Adversarial Bridges: Robust Windows Malware Detection Against Binary-level Mutations

Countering Malicious Processes with Process-DNS Association.

PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System

In-execution dynamic malware analysis and detection by mining information in process control blocks of Linux OS

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

Tools and Techniques for Malware Detection and Analysis

Enhancing Enterprise Network Security: Comparing Machine-Level and Process-Level Analysis for Dynamic Malware Detection

PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection

A survey on hardware-based malware detection approaches

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

Malware Detection and Tracer Approach for Operating System

Malware Detection in Adversarial Settings