Abstract:In cybersecurity, adversaries employ a myriad of tactics to evade detection and breach defenses. Malware remains a formidable weapon in their arsenal. To counter this threat, researchers unceasingly pursue dynamic analysis, which aims to comprehend and thwart established malware strains. This paper introduces an innovative methodology for dynamic malware analysis while critically evaluating prevailing technologies and their limitations. The proposed approach hinges on harnessing the capabilities of an open-source Security Information and Event Management (SIEM) toolset, namely the Elastic-Stack. This toolset is utilized to capture, structure, and analyze the behavioral patterns of malware without relying on any pre-existing sandbox framework. This augmentation facilitates a profound understanding of the activities exhibited by malware samples. With the help of the proposed ecosystem, we compile the AAU_MalData dataset that encompasses distinctly the benign and malicious behavior. Specifically, we analyzed the behavior of the 2,800 malware within a realistic network topology and systematically collected Windows event logs, which serve as a comprehensive record of the malware's actions. These event logs are precious as they are organized in a timestamped format, providing a chronological list of system activities, such as event descriptions, process and file details, and registry modifications. These are pivotal in comprehending the malware's functionality and repercussions on the compromised system. Furthermore, by incorporating the MITRE ATT&CK framework, we leveraged the event logs to correlate the malware's mode of operation, delve into its Command and Control operations, and investigate its persistence mechanisms, enabling a structured and practical approach to malware analysis. The AAU_MalData dataset, organized in a JSON format data structure, is offered to the research community first as a proof of concept to demonstrate the toolset's feasibility for dynamic malware analysis and second as a potential training ground for anti-malware mechanisms based on host and network Indicators of Compromise (IoCs).

Leveraging Security Management with Low-Level System Monitoring and Visualization

SoK: A Minimalist Approach to Formalizing Analog Sensor Security.

Vulnerability Detection For Smart Grid Devices Via Static Analysis

WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices

Sustainable Adaptive Security

RBMon: Real Time System Behavior Monitoring Tool

Using SMART for Customized Monitoring of Windows Services

Autonomous Low Power IoT System Architecture for Cybersecurity Monitoring

Present and Future of Network Security Monitoring

Trustworthy Environmental Monitoring Using Hardware-Assisted Security Mechanisms

MSNM-Sensor: An Applied Network Monitoring Tool for Anomaly Detection in Complex Networks and Systems

Towards adaptive and proactive security assessment for energy delivery systems

Security in Monitoring Schemes: A Survey

Data-Driven Threat Hunting Using Sysmon

Smart Devices Security Enhancement via Power Supply Monitoring

Automation of System Security Vulnerabilities Detection Using Open-Source Software

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

Kernel-Based Real-Time File Access Monitoring Structure for Detecting Malware Activity

Linux Security: A Survey

DESIGN AND IMPLEMENTATION OF SECURITY AUDITING SYSTEM FOR LINUX SERVER