{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/malware-triage-for-early-identification-of","title":"Malware triage for early identification of Advanced Persistent Threat activities","arxiv_id":"1810.07321","date":"2018-10-16","proceeding":null,"authors":["Giuseppe Laurenza","Riccardo Lazzeretti","Luca Mazzotti"],"abstract":"In the last decade, a new class of cyber-threats has emerged. This new\ncybersecurity adversary is known with the name of \"Advanced Persistent Threat\"\n(APT) and is referred to different organizations that in the last years have\nbeen \"in the center of the eye\" due to multiple dangerous and effective attacks\ntargeting financial and politic, news headlines, embassies, critical\ninfrastructures, TV programs, etc. In order to early identify APT related\nmalware, a semi-automatic approach for malware samples analysis is needed. In\nour previous work we introduced a \"malware triage\" step for a semi-automatic\nmalware analysis architecture. This step has the duty to analyze as fast as\npossible new incoming samples and to immediately dispatch the ones that deserve\na deeper analysis, among all the malware delivered per day in the cyber-space,\nthe ones that really worth to be further examined by analysts. Our paper\nfocuses on malware developed by APTs, and we build our knowledge base, used in\nthe triage, on known APTs obtained from publicly available reports. In order to\nhave the triage as fast as possible, we only rely on static malware features,\nthat can be extracted with negligible delay, and use machine learning\ntechniques for the identification. In this work we move from multiclass\nclassification to a group of oneclass classifier, which simplify the training\nand allows higher modularity. The results of the proposed framework highlight\nhigh performances, reaching a precision of 100% and an accuracy over 95%","url_abs":"http://arxiv.org/abs/1810.07321v1","url_pdf":"http://arxiv.org/pdf/1810.07321v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"malware-triage-for-early-identification-of","repo_url":"https://github.com/GiuseppeLaurenza/I_F_Identifier","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":null}],"tasks":[{"task_slug":"malware-analysis","task_name":"Malware Analysis"}],"methods":[],"datasets_introduced":[{"slug":"apt-malware","name":"APT-Malware","full_name":null}],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}