Abstract:In cybersecurity, adversaries employ a myriad of tactics to evade detection and breach defenses. Malware remains a formidable weapon in their arsenal. To counter this threat, researchers unceasingly pursue dynamic analysis, which aims to comprehend and thwart established malware strains. This paper introduces an innovative methodology for dynamic malware analysis while critically evaluating prevailing technologies and their limitations. The proposed approach hinges on harnessing the capabilities of an open-source Security Information and Event Management (SIEM) toolset, namely the Elastic-Stack. This toolset is utilized to capture, structure, and analyze the behavioral patterns of malware without relying on any pre-existing sandbox framework. This augmentation facilitates a profound understanding of the activities exhibited by malware samples. With the help of the proposed ecosystem, we compile the AAU_MalData dataset that encompasses distinctly the benign and malicious behavior. Specifically, we analyzed the behavior of the 2,800 malware within a realistic network topology and systematically collected Windows event logs, which serve as a comprehensive record of the malware's actions. These event logs are precious as they are organized in a timestamped format, providing a chronological list of system activities, such as event descriptions, process and file details, and registry modifications. These are pivotal in comprehending the malware's functionality and repercussions on the compromised system. Furthermore, by incorporating the MITRE ATT&CK framework, we leveraged the event logs to correlate the malware's mode of operation, delve into its Command and Control operations, and investigate its persistence mechanisms, enabling a structured and practical approach to malware analysis. The AAU_MalData dataset, organized in a JSON format data structure, is offered to the research community first as a proof of concept to demonstrate the toolset's feasibility for dynamic malware analysis and second as a potential training ground for anti-malware mechanisms based on host and network Indicators of Compromise (IoCs).

SCMA: Scalable and Collab orative Malw are Analysis using System Call Sequences

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Malware Analysis Using Machine Learning and Deep Learning Techniques

AMCAS: an Automatic Malicious Code Analysis System

A malware detection framework based on kolmogorov complexity

Method of Malware Behavior Analysis in Disassembly Level

CSMC: A Secure and Efficient Visualized Malware Classification Method Inspired by Compressed Sensing

Malware Detection and Analysis Tools

Malanalyser: An Effective and Efficient Windows Malware Detection Method Based on Api Call Sequences

SCGDet: Malware Detection using Semantic Features Based on Reachability Relation

Mwsandbox: On Improving The Efficiency Of Automated Coarse-Grained Dynamic Malware Analysis

Back-propagation Neural Network on Markov Chains from System Call Sequences: a New Approach for Detecting Android Malware with System Call Sequences.

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

Impeding Behavior-Based Malware Analysis Via Replacement Attacks to Malware Specifications

MalwareTotal: Multi-Faceted and Sequence-Aware Bypass Tactics Against Static Malware Detection

Cscdroid: Accurately Detect Android Malware Via Contribution-Level-Based System Call Categorization

Malware Analysis and Detection Using Machine Learning Algorithms

Using IRP and local alignment method to detect distributed malware

Virtual Machine Introspection Based Malware Behavior Profiling and Family Grouping

Malware Collusion Attack Against SVM: Issues and Countermeasures