Abstract:In cybersecurity, adversaries employ a myriad of tactics to evade detection and breach defenses. Malware remains a formidable weapon in their arsenal. To counter this threat, researchers unceasingly pursue dynamic analysis, which aims to comprehend and thwart established malware strains. This paper introduces an innovative methodology for dynamic malware analysis while critically evaluating prevailing technologies and their limitations. The proposed approach hinges on harnessing the capabilities of an open-source Security Information and Event Management (SIEM) toolset, namely the Elastic-Stack. This toolset is utilized to capture, structure, and analyze the behavioral patterns of malware without relying on any pre-existing sandbox framework. This augmentation facilitates a profound understanding of the activities exhibited by malware samples. With the help of the proposed ecosystem, we compile the AAU_MalData dataset that encompasses distinctly the benign and malicious behavior. Specifically, we analyzed the behavior of the 2,800 malware within a realistic network topology and systematically collected Windows event logs, which serve as a comprehensive record of the malware's actions. These event logs are precious as they are organized in a timestamped format, providing a chronological list of system activities, such as event descriptions, process and file details, and registry modifications. These are pivotal in comprehending the malware's functionality and repercussions on the compromised system. Furthermore, by incorporating the MITRE ATT&CK framework, we leveraged the event logs to correlate the malware's mode of operation, delve into its Command and Control operations, and investigate its persistence mechanisms, enabling a structured and practical approach to malware analysis. The AAU_MalData dataset, organized in a JSON format data structure, is offered to the research community first as a proof of concept to demonstrate the toolset's feasibility for dynamic malware analysis and second as a potential training ground for anti-malware mechanisms based on host and network Indicators of Compromise (IoCs).

An Efficient Tactic for Analysis and Evaluation of Malware Dump File Using the Volatility Tool

Analyzing Malware Based on Volatile Memory.

Malware Analysis Using Machine Learning and Deep Learning Techniques

Tools and Techniques for Malware Detection and Analysis

Process based volatile memory forensics for ransomware detection

Dynamic Analysis of Malicious Code

A Static Approach for Malware Analysis: A Guide to Analysis Tools and Techniques

Malware Detection and Analysis Tools

A study on malicious software behaviour analysis and detection techniques: Taxonomy, current trends and challenges

Malware Dynamic Analysis Evasion Techniques: A Survey

Malware Detection Approach Based on Artifacts in Memory Image and Dynamic Analysis

An Impact Analysis of Damage Level caused by Malware with Dynamic Analysis Approach

Dynamic Malware Analysis Using a Sandbox Environment, Network Traffic Logs, and Artificial Intelligence.

A Novel Malware Detection System Based On Machine Learning and Binary Visualization

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Malanalyser: An Effective and Efficient Windows Malware Detection Method Based on Api Call Sequences

Obfuscated Malware Detection: Investigating Real-world Scenarios through Memory Analysis

The Evolution of Volatile Memory Forensics

Redefining Malware Sandboxing: Enhancing Analysis Through Sysmon and ELK Integration

A Systematic Evaluation on Malware and its Behaviour

Malware detection system based on static and dynamic analysis and using machine learning