Abstract:In cybersecurity, adversaries employ a myriad of tactics to evade detection and breach defenses. Malware remains a formidable weapon in their arsenal. To counter this threat, researchers unceasingly pursue dynamic analysis, which aims to comprehend and thwart established malware strains. This paper introduces an innovative methodology for dynamic malware analysis while critically evaluating prevailing technologies and their limitations. The proposed approach hinges on harnessing the capabilities of an open-source Security Information and Event Management (SIEM) toolset, namely the Elastic-Stack. This toolset is utilized to capture, structure, and analyze the behavioral patterns of malware without relying on any pre-existing sandbox framework. This augmentation facilitates a profound understanding of the activities exhibited by malware samples. With the help of the proposed ecosystem, we compile the AAU_MalData dataset that encompasses distinctly the benign and malicious behavior. Specifically, we analyzed the behavior of the 2,800 malware within a realistic network topology and systematically collected Windows event logs, which serve as a comprehensive record of the malware's actions. These event logs are precious as they are organized in a timestamped format, providing a chronological list of system activities, such as event descriptions, process and file details, and registry modifications. These are pivotal in comprehending the malware's functionality and repercussions on the compromised system. Furthermore, by incorporating the MITRE ATT&CK framework, we leveraged the event logs to correlate the malware's mode of operation, delve into its Command and Control operations, and investigate its persistence mechanisms, enabling a structured and practical approach to malware analysis. The AAU_MalData dataset, organized in a JSON format data structure, is offered to the research community first as a proof of concept to demonstrate the toolset's feasibility for dynamic malware analysis and second as a potential training ground for anti-malware mechanisms based on host and network Indicators of Compromise (IoCs).

A distributed malware detection model based on sandbox technology

State-based Sandbox Tool for Distributed Malware Detection with Avoid Techniques

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

A Study on the Application of Distributed System Technology-Guided Machine Learning in Malware Detection

Advanced Cybersecurity Enhancement through Mathematical Models: A Comprehensive Approach Using Statistical Methods, Cryptographic Techniques, and Machine Learning Algorithms (SVM, Random Forest, and Neural Networks) for Behavior-Based Malware Detection

Malware detection system based on static and dynamic analysis and using machine learning

A malware detection framework based on kolmogorov complexity

Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis

VDS : Malware Detection System

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

An Efficient DenseNet-Based Deep Learning Model for Malware Detection

An optimal distributed malware defense system for mobile networks with heterogeneous devices

A Malware Detection Method Based on Sandbox, Binary Instrumentation and Multidimensional Feature Extraction

Discovering Malicious Signatures in Software from Structural Interactions

Service Reliability and Availability Analysis of Distributed Software Systems Considering Malware Attack

POW-HOW: An enduring timing side-channel to evade online malware sandboxes

Optimal Distributed Malware Defense in Mobile Networks with Heterogeneous Devices

A study on malicious software behaviour analysis and detection techniques: Taxonomy, current trends and challenges

Artificial Intelligence-Based Malware Detection, Analysis, and Mitigation

Malware Detection Module using Machine Learning Algorithms to Assist in Centralized Security in Enterprise Networks

Dynamic Analysis Scheme of Android Malware Based on Sandbox