DeepAPT: Nation-state APT attribution using end-to-end deep neural networks

Ishai Rosenberg, Guillaume Sicard, Eli Omid David

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

25 Scopus citations

Abstract

In recent years numerous advanced malware, aka advanced persistent threats (APT) are allegedly developed by nation-states. The task of attributing an APT to a specific nation-state is extremely challenging for several reasons. Each nation-state has usually more than a single cyber unit that develops such advanced malware, rendering traditional authorship attribution algorithms useless. Furthermore, those APTs use state-of-the-art evasion techniques, making feature extraction challenging. Finally, the dataset of such available APTs is extremely small. In this paper we describe how deep neural networks (DNN) could be successfully employed for nation-state APT attribution. We use sandbox reports (recording the behavior of the APT when run dynamically) as raw input for the neural network, allowing the DNN to learn high level feature abstractions of the APTs itself. Using a test set of 1,000 Chinese and Russian developed APTs, we achieved an accuracy rate of 94.6%.

Original languageEnglish
Title of host publicationArtificial Neural Networks and Machine Learning – ICANN 2017 - 26th International Conference on Artificial Neural Networks, Proceedings
EditorsAlessandra Lintas, Alessandro E. Villa, Stefano Rovetta, Paul F. Verschure
PublisherSpringer Verlag
Pages91-99
Number of pages9
ISBN (Print)9783319686110
DOIs
StatePublished - 2017
Externally publishedYes
Event26th International Conference on Artificial Neural Networks, ICANN 2017 - Alghero, Italy
Duration: 11 Sep 201714 Sep 2017

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume10614 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference26th International Conference on Artificial Neural Networks, ICANN 2017
Country/TerritoryItaly
CityAlghero
Period11/09/1714/09/17

Bibliographical note

Publisher Copyright:
© Springer International Publishing AG 2017.

Fingerprint

Dive into the research topics of 'DeepAPT: Nation-state APT attribution using end-to-end deep neural networks'. Together they form a unique fingerprint.

Cite this