Detecting malware communities using socio-cultural cognitive mapping

Iain Cruickshank (), Anthony Johnson (), Timothy Davison (), Matthew Elder () and Kathleen M. Carley ()
Additional contact information
Iain Cruickshank: Carnegie Mellon University
Anthony Johnson: Johns Hopkins University
Timothy Davison: Johns Hopkins University
Matthew Elder: Johns Hopkins University
Kathleen M. Carley: Carnegie Mellon University

Computational and Mathematical Organization Theory, 2020, vol. 26, issue 3, No 3, 307-319

Abstract: Abstract We apply a variation of socio-cultural cognitive mapping (SCM) to computer malware features explored previously by Saxe and Berlin that characterized malware binaries as benign or malicious based on 1024 program features derived from a deep neural network-based detection system. In this work, we model the features as attributes within a latent spatial domain using a weighted consensus graph representation to visualize and analyze the malware binary communities. The data used in our analysis is extracted from a Remote Access Trojan family named Sakula that first appeared in 2012, and has been used to enable an adversary to run interactive commands and execute remote program functions. Our results show that by SCM we were able to identify distinct malware communities within the malware family, which revealed insights into the overall structure of the various binaries as well as possible temporal relationships between the binaries.

Keywords: Malware analysis; Social network analysis; Cognitive mapping; Graph learning (search for similar items in EconPapers)
Date: 2020
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1007/s10588-019-09300-w Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:comaot:v:26:y:2020:i:3:d:10.1007_s10588-019-09300-w

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/10588

DOI: 10.1007/s10588-019-09300-w

Access Statistics for this article

Computational and Mathematical Organization Theory is currently edited by Terrill Frantz and Kathleen Carley

More articles in Computational and Mathematical Organization Theory from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().