Using synthetic data and unsupervised learning methods for malware detection

使用合成数据和无监督学习方法进行恶意软件检测

• 批准号: 10076857
• 金额: $ 3.31万
• 依托单位: UNIVERSITY OF STRATHCLYDE
• 依托单位国家: 英国
• 项目类别: Collaborative R&D
• 财政年份: 2023
• 资助国家: 英国
• 起止时间: 2023 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=10076857
• 关键词: Using; synthetic; data; unsupervised; learning

The rise of destructive cyber capabilities such as malware poses an increasing threat to the public and private sector in the UK. In the coming years, the National Cyber Security Council anticipates that the proliferation and commercial availability of cyber capabilities will expand the cyber security threat to the UK. In the future, malicious and disruptive cyber tools will be available to a wider range of state and non-state actors and will be deployed with greater frequency and with less predictability. In order to defend against the influx of new malware variants and increasingly sophisticated attacks, it is imperative to develop systematic mechanisms to detect them. We plan to develop a "vaccine" type approach using a controlled environment to understanding the spread of malware. This approach will simulate the complex nature of the data and then develop tools based innovative data analytic methodologies to try to detect the signature of malware attacks. This process will involve extensive interaction with domain experts to validate and refine the techniques. We believe that this process of end user co-creation and engagement could lead to wide deployment.

恶意软件等破坏性网络能力的兴起对英国公共和私营部门构成了越来越大的威胁。国家网络安全委员会预计，未来几年网络能力的扩散和商业可用性将扩大对英国的网络安全威胁。未来，恶意和破坏性网络工具将可供更广泛的国家和非国家行为者使用，并且将以更高的频率和更低的可预测性进行部署。为了防御新恶意软件变种的涌入和日益复杂的攻击，必须开发系统机制来检测它们。我们计划开发一种“疫苗”类型的方法，使用受控环境来了解恶意软件的传播。这种方法将模拟数据的复杂性质，然后开发基于创新数据分析方法的工具，以尝试检测恶意软件攻击的签名。此过程将涉及与领域专家的广泛互动，以验证和完善技术。我们相信，最终用户共同创建和参与的过程可能会导致广泛部署。