Enhancing Malware Classification Through Dynamic Behavioral Analysis, SIEM Integration, and Deep Learning

This study explores the current landscape of malicious software attacks, characterized by sophisticated alterations to existing malware and efforts to conceal their true nature, which present significant hurdles in identifying and categorizing them. Our approach involves extracting dynamic behavioral cues that may emerge during these attacks. We employ a sandbox environment to detect potential infection attempts as they occur in real-time. Additionally, we incorporate a Security Information and Event Management (SIEM) solution into our analysis framework to gain valuable insights into system activities during sandbox examination. This enables the identification of critical details such as API calls, network traffic, process, and registry operations, essential for comprehensive analysis. Furthermore, for the purpose of classification, we utilize the VirusTotal API for labeling the malware samples. Following this, we employ Deep Learning-based classifiers, specifically Long Short-Term Memory (LSTM) and Convolutional Neural Networks (CNN). These classifiers are assessed based on various metrics including Accuracy, Precision, Recall, and F1-Score. Our experimental findings indicate that our system achieves a noteworthy prediction accuracy of 96. As a result, our proposed system presents an effective solution for categorizing malware.