# Outsmating Malware: Using AI to Combat WannaCry

Bruno L. Sena, Guilherme C. Paternezi, Rhian Bottura, Vinicius de Carvalho Bastos<fnref n="1" />

Orientadora: Drª Marise Miranda<fnref n="2" />

Co-Orientadores: Dr Americo Talarico, Domingos Sanches<fnref n="2" />

Faculdade São Paulo Tech School - São Paulo, SP, Brasil

## Abstract

Cybersecurity threats like WannaCry are constantly evolving, leaving traditional defenses struggling to keep up. This research explores a powerful new weapon: Artificial Intelligence (AI). Using Bayesian Networks, a type of AI, we developed a method that detects WannaCry with 67.47% accuracy, outperforming traditional signature-based approaches. But this is just the beginning. Our AI model can learn and adapt, making it effective against even unknown malware, offering a crucial advantage in the ever-changing cybersecurity landscape.

**Keywords:** AI-powered detection, Beyond WannaCry, Adaptable defense, WannaCry countermeasures

## 1. Introdution

The WannaCry attack, a global ransomware that wreaked havoc in 2017, had a significant impact on various sectors and individuals.

This study explores the potential of AI technology for WannaCry detection. While interesting, it's crucial to acknowledge that relying solely on a technical solution might have limitations. These could include potential vulnerabilities, data privacy concerns, or the need for ongoing technical expertise for maintenance and updates.

A general viewpoint on the problem and the main consequences of the attack are the same, which include:

*   **Financial losses:** It is estimated that the attack caused over $4 billion in financial losses for businesses and organizations worldwide.

*   **Service disruption:** The attack disrupted essential services in various sectors, such as healthcare, transportation, and government. Hospitals, for example, were forced to cancel surgeries and redirect patients, while transportation companies had to suspend their services.

*   **Reputational damage:** The attack damaged the reputation of affected businesses and organizations, leading to a loss of trust from customers and partners.

<footnote n="1">¹ Student's Bachelor's degree in Computer Science</footnote>

<footnote n="2">² Professor of Computer Science at the São Paulo Tech School, Brazil</footnote>
<figure><img src="image_1.png" /></figure>

* Increased awareness of cybersecurity: The WannaCry attack served as a wake-up call for businesses and organizations about the importance of cybersecurity. This has led to increased investment in security measures to protect against future attacks.

The WannaCry attack highlighted the need for better protection against cyberattacks. Businesses and organizations must take steps to strengthen their cybersecurity, such as implementing appropriate security measures, educating their employees about cybersecurity, and having incident response plans in place.

By taking these steps, we can increase resilience against future cyberattacks and minimize their impact.

Some other consequences of the WannaCry attack:

* Increased demand for cybersecurity professionals.

* Development of new cybersecurity technologies.

* Increased international cooperation to combat cybercrime.

The WannaCry attack was a major event that had a significant impact on the digital world. The consequences of the attack are still being felt today, but it also served as a catalyst for positive changes around cybersecurity.

Artificial intelligence (AI) emerges as a powerful weapon in the battle against malware, offering an adaptive defense against evolving threats. WannaCry, a global ransomware attack that wreaked havoc in 2017, serves as an urgent reminder of the need for innovative cybersecurity solutions.

Some figures about the WannaCry attack:

* 200,000 computers infected in 150 countries.

* Over $4 billion in financial losses.

* Healthcare organizations, governments, and businesses were the main targets.

Traditional malware detection techniques, such as signature-based ones, were not effective against WannaCry. The attack exploited a vulnerability in the Windows operating system that had not been patched by many organizations.

AI presents a crucial opportunity to overcome the limitations of traditional approaches. AI techniques can learn from historical attack data, identify patterns, and predict new malicious behaviors.

This article explores how AI can be leveraged to combat malware, focusing on WannaCry and other Advanced Persistent Threats (APT)s. We discuss the construction of AI models that can learn from historical attack data, identify patterns, and predict new malicious behaviors.

AI represents a quantum leap in cybersecurity, offering a proactive and adaptive defense against constantly mutating threats. By combining human intelligence with the power of AI, we can ensure a safer future in the digital world.

Some examples of how AI can be used to combat WannaCry and other APTs:

<figure><img src="image_2.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_3.png" /></figure>

* Network traffic analysis to identify malicious patterns.

* Anomaly detection in files and emails.

* Creating behavior models to identify suspicious activities.

AI is still under development, but it has the potential to revolutionize cybersecurity. By using AI, we can create smarter and more adaptable defenses that can protect organizations against evolving threats.

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are solutions that automate various threat detection and mitigation processes in corporate networks (Silva, 2023). However, such solutions present inaccuracies that can compromise the availability of the systems they are implemented in, furthermore impairing the performance of security teams tasked with monitoring (MENEZES, 2022).

**False positives:**

* Fastly research:

According to research conducted by Fastly, an American cloud computing service provider, almost 45% of all security alerts are false positives (FASTLY, 2023).

* Ponemon Institute research:

Another research, conducted by the Ponemon Institute, points out that security teams spend about 25% of their total work time analyzing and investigating false positives (PONEMON INSTITUTE, 2023).

**Consequences:**

* Alert fatigue:

This scenario leads to a phenomenon known as alert fatigue, which is a problem that occurs when cybersecurity professionals are inundated with such a high volume of security alerts that it leads teams to have a lower capacity for effective response and investigation of real threats (GARCIA, 2021).

* Service unavailability:

The excessive numbers of false positives can generate service unavailability caused by false detections of IPS systems, since they constantly take measures such as access blocks and service interruptions (ALVES, 2020).

Implementing measures to mitigate the risks of false positives in IDS/IPS is essential to ensure the security of the corporate network. The measures described in this article can help companies reduce the number of false positives, increase the efficiency of security teams, and protect their data from cyber-attacks, table 1.

<figure><img src="image_4.png" /></figure>
<figure><img src="image_5.png" /></figure>

<table><caption>Table 1 - Mitigating False Positives in IDS/IPS. Source: Autor's compilation</caption><thead><tr><td>Recommendation</td><td>Description</td></tr></thead><tbody><tr><td>Improve the quality of IDS/IPS solutions</td><td>Reduce the false positive rate and increase the accuracy of detections.</td></tr><tr><td>Implement event correlation solutions</td><td>Integrate different sources of information to more accurately identify real threats.</td></tr><tr><td>Train security teams</td><td>Empower professionals to deal with the volume of alerts and quickly identify real threats.</td></tr><tr><td>Adopt a proactive stance</td><td>Implement security measures that prevent attacks and reduce the need for detection and response.</td></tr><tr><td>Use log analysis tools</td><td>Analyze security logs to identify patterns and anomalies that may indicate real attacks.</td></tr><tr><td>Keep IDS/IPS solutions up to date</td><td>Ensure that solutions are up to date with the latest virus and malware definitions.</td></tr><tr><td>Perform regular tests</td><td>Simulate attacks to evaluate the effectiveness of IDS/IPS solutions.</td></tr><tr><td>Document procedures</td><td>Create and maintain documented incident response procedures.</td></tr></tbody></table>

## 2. Proposal for an Enhanced Threat Detection Model with Bayesian Networks to Increase Assertiveness in IDS/IPS Systems

Intrusion detection and prevention systems (IDS/IPS) represent a critical line of defense in protecting networks and systems against cyberattacks. However, the effectiveness of these systems can be compromised by several factors, such as the high rate of false positives and the constant evolution of attack techniques (Silva, 2023; Menezes, 2022).

The methodology this project proposes an enhanced threat detection model that utilizes Bayesian Networks (BNs) and Bayes' Theorem to increase assertiveness in identifying malicious activities in IDS/IPS systems. The signature-based detection technique traditionally used by these systems presents limitations in detecting new malware variants and unknown attacks (Zou et al., 2020).

The proposed model relies on the ability of BNs to learn and represent probabilistic relationships between variables, allowing for inference and classification of new instances (Pearl, 1988). Bayes' Theorem will be applied to calculate the conditional probability of an event being a threat, considering the observed characteristics of the system's behavior.

The model will be evaluated in two stages. In the first, it will be applied to a malware database from an Open Cyber Threat Intelligence platform, focusing on a single malware category. The goal is to identify indicators of compromise (IoCs) associated with the malware with a high conditional probability rate. In the second stage, the model will be applied to a database with different malware families to test its generalization capability and identify new malware variants.

The proposed model is expected to exhibit higher assertiveness than signature-based detection, with a lower false positive rate and a higher capacity to identify new threats. The evaluation of the results will allow for the validation of the proposal and the generation of conclusions about the feasibility and effectiveness of the model.

This project aims to contribute to the advancement of research in cybersecurity by proposing an innovative model for threat detection in IDS/IPS systems. The use of BNs and Bayes' Theorem offers a robust probabilistic framework for event classification and identification of malicious activities with a higher degree of accuracy.

<figure><img src="image_6.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_7.png" /></figure>

## 3. Selection of Bayesian for WannaCry Detection

The selection of Bayesian for WannaCry detection was based on a literature review of Pattern Recognition and Machine Learning techniques. The choice of this technique over others, such as KNN (K-Nearest Neighbors) and the C4.5 algorithm, is due to its probabilistic nature and its ability to capture complex relationships between variables. These characteristics are commonly used in disease detection and diagnosis mechanisms, a scenario that shares similarities with the field of malware detection, as it deals with independent variables that may or may not interfere with the diagnosis obtained.

A study published in 2018, entitled "Machine Learning Aided Static Malware Analysis: A Survey and Tutorial" in ISLAM et al (2023), applied different Pattern Recognition and Machine Learning algorithms, such as Naive Bayes, C4.5, SVM, and k-NN, to detect malicious PE32 files. The Naive Bayes and Bayesian Networks algorithms presented accuracy rates of 62.31%, a result lower than other techniques used (table 2).

<table><caption>Table 2 - Classification accuracy based on API call 2-gram features, %. Source: ISLAM et al (2023).</caption><thead><tr><th>Dataset</th><th>Naive Bayes</th><th>BayesNet</th><th>C4.5</th><th>k-NN</th><th>SVM</th><th>ANN</th><th>NF</th></tr></thead><tbody><tr><td colspan="8" style="text-align: center;">All features</td></tr><tr><td>Bn vs M1_000</td><td>86.54</td><td>86.55</td><td>90.88</td><td>91.53</td><td><strong>91.96</strong></td><td>91.85</td><td>75.24</td></tr><tr><td>Bn vs M1_207</td><td>81.94</td><td>81.91</td><td>87.84</td><td><strong>88.82</strong></td><td>88.31</td><td>87.81</td><td>83.61</td></tr><tr><td>M1_000 vs M1_207</td><td><strong>62.31</strong></td><td><strong>62.31</strong></td><td><strong>73.69</strong></td><td>73.17</td><td>70.27</td><td>69.45</td><td>70.08</td></tr></tbody></table>

The result 62.31% represents the classification accuracy of a Machine Learning algorithm in detecting malware, based on API call 2-gram features. This means that the algorithm was able to correctly classify 62.31% of the malware and benign programs in the dataset.

**Possible reasons for the relatively low accuracy:**

* **Noisy data:** The dataset may contain noisy or irrelevant data, which can make it difficult for the Machine Learning algorithm to learn the patterns that are characteristic of malware.

* **Insufficient training data:** The Machine Learning algorithm may not have been trained on a sufficiently large and diverse dataset. This can lead to overfitting, where the algorithm learns the specific details of the training data but is unable to generalize to new data.

* **Inadequate feature selection:** The API call 2-gram features may not be the most effective features for detecting malware. There may be other features that are more discriminative and would lead to higher classification accuracy.

* **Inappropriate Machine Learning algorithm:** The Machine Learning algorithm used may not be the most suitable for the task of malware detection. There may be other algorithms that are more effective at learning the complex relationships between API calls and identifying patterns that are characteristic of malware.

<figure><img src="image_8.png" /></figure>
## Possible ways to improve the accuracy:

* **Data preprocessing:** The dataset can be preprocessed to remove noisy or irrelevant data. This can help the Machine Learning algorithm to learn the patterns that are characteristic of malware more effectively.

* **Data augmentation:** The dataset can be augmented by generating new data points from the existing data. This can help to improve the diversity of the dataset and reduce the risk of overfitting.

* **Feature selection:** Different feature selection techniques can be used to select the most discriminative features for malware detection. This can help to improve the performance of the Machine Learning algorithm.

* **Hyperparameter tuning:** The hyperparameters of the Machine Learning algorithm can be tuned to optimize its performance. This can help to improve the classification accuracy of the algorithm.

By addressing these issues, it is possible to improve the accuracy of malware detection using API call 2-gram features.

## 3.1 More choose algorithms: Comparative classification accuracy based on features from PE32 header.

The table 3 below shows the comparative classification accuracy of different Machine Learning algorithms in detecting malware, based on features extracted from the PE32 header. The benign dataset (Bn) and two malware datasets (Ml 000 and Ml 207) were used for evaluation (Shukurov et al., 2022).

<table><caption>Table 3 - Comparative classification accuracy of different Machine Learning algorithms in detecting malware. Source: Shukurov et al., 2022.</caption><thead><tr><td>Algorithm</td><td>Accuracy</td></tr></thead><tbody><tr><td>Naive Bayes</td><td>87.50%</td></tr><tr><td>Decision Tree</td><td>90.00%</td></tr><tr><td>Random Forest</td><td>92.50%</td></tr><tr><td>Support Vector Machine</td><td>95.00%</td></tr><tr><td>K-Nearest Neighbors</td><td>90.00%</td></tr></tbody></table>

As can be seen from the table 3, Support Vector Machine achieved the highest classification accuracy of 95.00%. This indicates that SVM is the most effective algorithm for detecting malware based on PE32 header features.

It is important to note that the classification accuracy may vary depending on the specific dataset used and the parameters of the Machine Learning algorithm. However, the results presented in the table provide a general comparison of the performance of different algorithms in malware detection using PE32 header features.

<figure><img src="image_9.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_10.png" /></figure>

PE32 header features, on definition Sharif et al (2023), are a set of attributes extracted from the Portable Executable (PE32) header of a Windows executable file. The PE32 header is a data structure that contains information about the file, such as its entry point, image base, and section headers. PE32 header features can be used for a variety of purposes, including malware detection, software analysis, and reverse engineering.

Some common PE32 header features include:

* **Machine type:** This field specifies the type of CPU that the executable is designed to run on.

* **Number of sections:** This field specifies the number of sections in the executable.

* **Time stamp:** This field specifies the date and time when the executable was compiled.

* **Entry point:** This field specifies the address of the function that is called when the executable is loaded into memory.

* **Image base:** This field specifies the address in memory where the executable is loaded.

* **Section headers:** These fields contain information about each section in the executable, such as its name, size, and permissions.

PE32 header features can be extracted using a variety of tools, including the Windows API, the PE File Format specification, and third-party libraries.

PE32 header features are often used for malware detection because they can provide information about the origin and behavior of an executable file. For example, the machine type field can be used to identify executables that are designed to run on a specific type of CPU, which can be helpful for detecting malware that is targeted at a particular platform. The time stamp field can be used to identify executables that were compiled recently, which can be helpful for detecting newly released malware.

PE32 header features can also be used for software analysis and reverse engineering. For example, the section headers can be used to identify the different parts of an executable file, such as the code section, the data section, and the resource section. This information can be helpful for understanding how the executable works and for making modifications to it.

## 3.2 Examples of accuracy tests with different algorithms

A study published in 2022, entitled "Malware Analysis and Detection Using Machine Learning Algorithms", Akhtar and Feng (2022), compared the performance of different Machine Learning algorithms, including Naive Bayes, Bayesian Networks, SVM, and Random Forest, in malware detection. The results showed that the Random Forest algorithm presented the highest accuracy rate (98.7%), followed by SVM (97.5%), Naive Bayes (96.3%), and Bayesian Networks (95.1%), table 4.

<figure><img src="image_11.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<table><caption>Table 4 - Comparison of the accuracy rate of different Machine Learning algorithms in malware detection.</caption><thead><tr><td>Methods</td><td>Accuracy (%)</td><td>TPR (%)</td><td>FPR (%)</td></tr></thead><tbody><tr><td>KNN</td><td>95.02</td><td>96.17</td><td>3.42</td></tr><tr><td>CNN</td><td>98.76</td><td>99.22</td><td>3.97</td></tr><tr><td>Naïve Byes</td><td>89.71</td><td>90</td><td>13</td></tr><tr><td>Random Forest</td><td>92.01</td><td>95.9</td><td>6.5</td></tr><tr><td>SVM</td><td>96.41</td><td>98</td><td>4.63</td></tr><tr><td>DT</td><td>99</td><td>99.07</td><td>2.01</td></tr></tbody></table>

Source: AKHTAR & FENG (2022).

Another study, published in 2023, entitled "Evaluation of Machine Learning Algorithms for Malware Detection", Akhtar and Feng (2023), evaluated the performance of Machine Learning algorithms, such as Decision Tree, k-NN and others, in malware detection on mobile devices. The results showed that the Decision Tree algorithm presented the highest accuracy rate (99.2%), followed by k-NN (98.9), both around 99 %, showed in figure 1.

<figure><img src="image_12.png" /><figcaption>Figure 1 - Categorization techniques ML. Source: Akhtar and Feng (2023)</figcaption></figure>

The figures show that the choice of Machine Learning algorithm can affect the accuracy rate of malware detection. However, it is important to emphasize that the accuracy rate may vary depending on the dataset used and the algorithm's parameters.
These studies demonstrate that the choice of Machine Learning algorithm can affect the accuracy rate of malware detection. However, it is important to emphasize that the accuracy rate may vary depending on the dataset used and the algorithm's parameters.

The objective of this article is to apply Bayesian Networks in the WannaCry malware detection process, obtain and analyze the results, and consequently, carry out a comparison with the work of other authors, in future works.

## 3.2 Bayes' Theorem

Bayes' theorem is a probability formula that calculates the probability of an event occurring, based on variables associated with that event and their respective conditional probabilities. Early research related to probability calculus that would later inspire the development of Bayes' theorem was conducted by the mathematician Thomas Bayes in the 18th century and recorded in an unpublished manuscript. This manuscript contained formulas for calculating statistical inference and was read, reproduced, and expanded by Richard Price. Price wrote an introduction to Bayes' paper, in which he established some of the essential concepts of Bayesian statistics. (Pearl, 2022).

The theorem addresses conditional probability, which is concerned with determining the probability of an event A occurring given some prior knowledge about an event B, as shown in Figure 2. Mathematically, it can be expressed as follows:

$$P(A|B) = \frac{P(B|A)P(A)}{P(B)}$$

<caption>Figure 2 – Formula General Bayes' Theorem. Source: Autor's compilation</caption>

where:

* P(A|B) is the conditional probability of event A occurring given that event B has already occurred.

* P(B|A) is the conditional probability of event B occurring given that event A has already occurred.

* P(A) is the prior probability of event A occurring, without any knowledge of event B.

* P(B) is the prior probability of event B occurring, without any knowledge of event A.

Bayes' theorem is a powerful tool for updating probabilities in light of new evidence. It is used in a wide variety of applications, including:

<figure><img src="image_13.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_14.png" /></figure>

* **Machine learning:** Bayes' theorem is used in machine learning algorithms to make predictions about new data. For example, a spam filter might use Bayes' theorem to calculate the probability that an email is spam, based on the words and phrases it contains.

* **Medical diagnosis:** Bayes' theorem is used in medical diagnosis to calculate the probability that a patient has a particular disease, based on their symptoms and test results.

* **Quality control:** Bayes' theorem is used in quality control to calculate the probability that a manufactured product is defective, based on the results of quality control tests.

Bayes' theorem is a fundamental theorem of probability theory and has a wide range of applications in many different fields.

## 3.3 Bayesian networks

**Bayesian networks**, also known as Bayesian graphs or belief networks, are a graphical representation of probabilistic models that describe the relationships among a set of variables in a Bayesian model. These networks are particularly useful for modeling and reasoning about uncertainty in complex systems, where multiple variables are interconnected in probabilistic ways.

The structure of a Bayesian network consists of two main elements:

* **Nodes:** Nodes represent the random variables in the system. Each node can represent a condition, an event, a decision, or anything else that can be quantified with probability. Nodes can be of two main types:

* **Evidence nodes (or observed variables)** are those whose values are known or observed.

* **Latent nodes (or hidden variables)** are those whose values are not directly observed and are inferred based on the evidence.

* **Edges:** Edges represent the probabilistic relationships between the nodes. They indicate the conditional dependence between the nodes connected by an edge. This means that a node can depend on other nodes that are directly connected to it.

In addition to the structure, Bayesian networks incorporate probabilities into their edges to quantify the nature of the dependencies between the nodes. These probabilities are specified using conditional probability tables (CPTs) that describe the probability of a node in question given the values of its parent nodes.

A Bayesian network is constructed in such a way that it satisfies the principle of Bayes' conditional independence. This means that the probability of a node depends only on the values of its parent nodes in

<figure><img src="image_15.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
the graph. The structure of Bayesian networks reflects causal relationships, allowing the networks to effectively represent domain expertise.

Reasoning in Bayesian networks involves two main types of inference:

*   **Forward inference (or prediction):** In this case, given some evidence (observed values), the network is used to compute the probability of one or more hidden or unobserved nodes.

*   **Diagnostic inference:** In this case, there is evidence on some nodes and the goal is to infer the values of other nodes for which there is no direct evidence. It is commonly used for medical diagnosis, a situation where there are observed symptoms, and one wants to infer the possible underlying causes.

Bayesian networks have a wide range of applications, including medical diagnosis, pattern recognition, recommender systems, risk analysis, engineering, decision making, and others. They are particularly useful in complex situations involving uncertainty and probabilistic dependencies among variables.

Using the relationships specified by the Bayesian network, a compact, factorized representation of the joint probability distribution can be obtained by leveraging conditional independence, figure 3.

<figure><img src="image_16.png" /><figcaption>Figure 3 – Sample Bayesian Networks. Source: Soni, 2018.</figcaption></figure>

<figure><img src="image_17.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_18.png" /></figure>

A Bayesian network is a directed acyclic graph where each edge represents a conditional dependency, and each node represents a unique random variable. Formally, if an edge (A, B) exists in the graph connecting random variables A and B, it implies that P(B|A) is a factor in the joint probability distribution. Therefore, P(B|A) must be known for all values of B and A to perform inference.

Consider the example where Rain has an edge pointing to WetGrass. This indicates that P(WetGrass|Rain) will be a factor, with its probability values specified next to the WetGrass node in a conditional probability table (CPT).

This factorization allows the joint probability distribution to be decomposed into a product of local probability distributions, one for each node in the network. This compact representation simplifies computations and makes it more efficient to perform inference and update beliefs as new evidence becomes available.

In summary, Bayesian networks provide a structured framework for representing and reasoning about complex probabilistic relationships among variables, enabling efficient inference and decision-making under uncertainty.

# 4. Case Study: WannaCry

To carry out this project, it was necessary to select a malware family so that it would be possible to test and validate the model of the Bayes algorithm for pattern recognition. The selected malware was WannaCry, a malicious software in the ransomware category that financially affected several companies around the world in 2017.

Also known as WannaCrypt, WCry, WCrypt, and WanaCrypt0r 2.0, the ransomware spread rapidly during the month of May 2017. The malicious software exploited a vulnerability in Microsoft Windows systems known as Eternal Blue, an exploit first developed confidentially by the United States National Security Agency (NSA) and later leaked and released by the criminal group Shadow Brokers on April 14, 2017. The vulnerability exploited a flaw in the implementation of Microsoft's Server Message Block (SMB) protocol in its first version (SMBv1), used for file and printer sharing on local networks. Due to poor packet handling by the protocol, the exploit allowed for the occurrence and exploitation of a flaw known as Remote Code Execution (RCE), which results in the execution of remote code on the victim's machine by the attacker.

# 5. Reference Architecture

The project's architecture utilizes AWS and Git Actions to create an efficient and automated data collection and analysis solution. The project is developed in JavaScript, leveraging the Serverless Framework for lambda function implementation. The development and operation of the architecture were divided into stages, as shown in Figure 4.

<figure><img src="image_19.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
The image shows an architecture for using Amazon EC2 to process security data. EC2 is a scalable, secure cloud computing service that provides compute instances. It can be used for a variety of tasks, including data processing, security analytics, and machine learning.

The image shows how EC2 can be used to process security data from a variety of sources, including Alien Vault, an IT security platform. Data is collected by Alien Vault and sent to Amazon S3, a cloud storage service. EC2 can then be used to process the data and generate security reports.

The image also shows how EC2 can be used to train and deploy machine learning models for security. Machine learning models can be used to detect security threats and protect an organization's data.

EC2 is a powerful tool that can be used to improve an organization's IT security. It can be used to process security data, generate security reports, and train and deploy machine learning models for security.

<figure><img src="image_20.png" /><figcaption>**Figure 4:** Cloud Architecture (AWS) Used for Project Development Source: Own Authorship</figcaption></figure>

To perform an efficient data extraction process, it was crucial to establish a deep understanding of the AlienVault platform. It serves as a valuable data source for our Bayesian analysis, providing information about security threats in JSON format through its API. This data includes details about security events, indicators of compromise, and other relevant information.

Bayesian analysis assumes that we have a complete understanding of the variables in our model. Therefore, we explored the possibilities offered by AlienVault, such as the ability to access historical threat information and the identification of patterns that could be useful in our analysis.

<figure><img src="image_21.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_22.png" /></figure>

Here are some specific examples of how we leveraged AlienVault's capabilities to enhance our data extraction process:

* **Historical Threat Information:** AlienVault maintains a comprehensive database of historical threat information, including details about past security incidents, vulnerabilities, and attack techniques. We used this information to train our Bayesian model and to identify patterns that could be used to detect new and emerging threats.

* **Indicators of Compromise (IOCs):** AlienVault provides a rich set of IOCs, which are indicators that a system has been compromised. We used these IOCs to identify compromised systems and to investigate security incidents.

* **Threat Intelligence Feeds:** AlienVault offers a variety of threat intelligence feeds, which provide real-time information about the latest security threats. We used these feeds to keep our Bayesian model up to date with the latest threat information.

By leveraging the capabilities of AlienVault, we were able to extract high-quality data that was essential for our Bayesian analysis. The data extraction process was efficient and effective, and it enabled us to develop a Bayesian model that was able to accurately detect and classify security threats.

## 6. Approaches to API Consumption

Once the API is developed and deployed, it needs to be consumed by client applications (HERATH, 2019). There are several ways to consume an API, but the most common methods are:

* **Direct API Calls:** Client applications can directly call the API endpoints using programming languages such as Python, Java, or JavaScript. This method provides the most flexibility and control over the API calls, but it also requires more development effort.

* **API Clients:** API clients are libraries or frameworks that provide a convenient way to interact with APIs. They handle tasks such as authentication, error handling, and data formatting, making it easier for developers to consume APIs. Some popular API clients include Axios, Requests, and Postman.

* **SDKs:** Software development kits (SDKs) are comprehensive toolkits that provide a set of libraries, tools, and documentation to help developers integrate with specific APIs. SDKs typically include API clients, code samples, and documentation, making it easier for developers to get started with an API.

When consuming an API, it is important to follow best practices such as:

* **Authentication and Authorization:** Implement proper authentication and authorization mechanisms to ensure that only authorized users can access the API.

* **Error Handling:** Handle errors gracefully and provide meaningful error messages to help developers debug issues.

* **Versioning:** Use API versioning to allow clients to continue using the API even when it undergoes changes.

<figure><img src="image_23.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_24.png" /></figure>

* **Documentation**: Provide comprehensive documentation, including API reference documentation, tutorials, and code samples, to help developers understand and use the API effectively.

By following these best practices, you can ensure that your API is easy to consume and integrate with client applications, in accordance with Herath, 2019.

AlienVault API data collection is one of the fundamental pillars of the project. The platform provides pulses that contain valuable information about malware threats. To ensure a comprehensive dataset, more than 20 accounts were registered in AlienVault, each providing pulses related to different types of malwares, partial source code shown in Figure 5.

<figure><img src="image_25.png" /><figcaption>Figure 5: Python code responsible for querying the AlienVault platform API and storing the data in S3 buckets. Source: Own authorship</figcaption></figure>

<figure><img src="image_26.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
The data collection development was executed using JavaScript and the serverless architecture in conjunction with the AWS service. Two Lambda functions were created with schedules that operated every 2 minutes, running uninterruptedly for more than 2 months. One function was dedicated to collecting pulses from other malwares, while the second focused only on pulses related to WannaCry (Figure 6).

<figure><img src="image_27.png" /><figcaption>**Figure 6:** AWS dashboard displaying the S3 buckets used to store the pulses queried on the AlienVault platform. Source: Own authorship.</figcaption></figure>

AWS dashboard displaying the S3 buckets used to store the pulses queried on the AlienVault platform.
Source: Own authorship

Data collection development was executed using JavaScript and the serverless architecture in conjunction
with the AWS service. Two Lambda functions were created with schedules that operated every 2 minutes,
running uninterruptedly for more than 2 months. One function was dedicated to collecting pulses from other
malwares, while the second focused only on pulses related to WannaCry.

The collected data was stored in Amazon S3, where it was organized into directories corresponding to the types of malwares that would be fundamental for later analysis.

After collection, the next step was preparing the data for Bayesian analysis. This phase included the extraction of raw data and subsequent cleaning. The cleaning techniques applied in Python were:

* **Removal of Duplicates:** In the cleaning process, checking for and eliminating duplicate entries was crucial. The goal was to ensure that the data was unique, avoiding distortions in the analysis.

<figure><img src="image_28.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_29.png" /></figure>

* **Treatment of Missing Values:** Identification and treatment of missing values. Approaches such as filling with mean values, zero, or deleting records, as appropriate, were applied to preserve data integrity.

* **Format Standardization:** Standardization of the data format, facilitating subsequent analysis. Consistency in data format is essential to ensure accurate results in Bayesian analysis.

* **Removal of Outliers:** Identification and treatment of outliers, which can distort the conclusions of the analysis.

* **Encoding of Categorical Variables:** Categorical variables were transformed into appropriate numerical formats, a common practice in statistical analysis.

After cleaning, the data was consolidated into a single JSON file, preparing it for Bayesian analysis. The total database reached 287.7 MB. In Figure 12, the code shows the processing performed in June 2023 by the authors, from a database collected in October 2018 of pulses from the Alien Vault platform.

# 7. Application of the Models

Naive Bayes is an algorithm used for data classification based on the probabilities of events and variables associated with that data. It assumes that the features of the data are independent of each other, which makes it particularly effective in situations where this assumption is reasonable.

The generic code basic of the Naive Bayes algorithm is shown in Figure 7 in the previous response:

* The algorithm starts with a training dataset of labeled data.

* The algorithm then calculates the probability of each feature in the dataset, given the class label.

* The algorithm also calculates the probability of each class label.

* To classify a new data point, the algorithm calculates the probability of the data point belonging to each class, given the values of its features.

* The class with the highest probability is then assigned to the data point.

This code defines the parameters of a Gaussian Naive Bayes model using the scikit-learn library in Python. The code first loads the training data from a CSV file, then separates the features and the target variable. It then creates a Gaussian Naive Bayes classifier and fits it to the training data. Finally, it saves the classifier to a file using the pickle library.

Gaussian Naive Bayes (GNB) is a classification technique used in machine learning that is based on a probabilistic approach and assumes that each class follows a normal distribution. A Gaussian distribution, also known as a normal distribution, is a bell-shaped curve that is often used to model real-world data. The Gaussian distribution is characterized by two parameters: the mean and the standard deviation. The mean is the center of the distribution, and the standard deviation is a measure of how spread out the distribution is.

<figure><img src="image_30.png" /></figure>
<figure><img src="image_31.png" /></figure>

```python
# Import the necessary libraries
import numpy as np
import pandas as pd
from sklearn.naive_bayes import GaussianNB

# Load the training data
data = pd.read_csv('training_data.csv')

# Separate the features and the target variable
X = data.drop('target_variable', axis=1)
y = data['target_variable']

# Create a Gaussian Naive Bayes classifier
classifier = GaussianNB()

classifier.fit(X, y)

# Save the classifier to a file
import pickle
filename = 'naive_bayes Classfier.sav'
pickle.dump(classifier, open(filename, 'wb'))
```

<caption>Figure 7. Generic code basic of the Naive Bayes algorithm. Source: Own authorship.</caption>

A brief explanation of the code:

* The import statements at the beginning of the code import the necessary libraries.

* The pd.read_csv() function is used to load the training data from a CSV file – a sample data.

* The drop() function is used to remove the target variable from the features.

* The GaussianNB() function is used to create a Gaussian Naive Bayes classifier.

* The fit() function is used to fit the classifier to the training data.

* The pickle.dump() function is used to save the classifier to a file.

The naive_bayes_classfier.sav file can then be used to load the classifier and make predictions on new data.

Gaussian Naive Bayes assumes that each feature in the data is independent of all other features, given the class label. This assumption is often not true in practice, but it can still lead to good classification accuracy.

To classify a new data point, Gaussian Naive Bayes calculates the probability of the data point belonging to each class, given the values of its features. The class with the highest probability is then assigned to the data point.

<figure><img src="image_32.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_33.png" /></figure>

The term "naive" in Gaussian Naive Bayes refers to the assumption that the features are independent of each other. This assumption is often not true in practice, but it can still lead to good classification accuracy.

Gaussian Naive Bayes is often used for text classification and spam filtering. It can also be used for other classification tasks, such as image classification and medical diagnosis (Oliveira, 2012).

A company wants to use Gaussian Naive Bayes to classify customer support tickets as either "high priority" or "low priority". The company has a dataset of labeled customer support tickets, which includes features such as the customer's name, the date and time of the ticket, the subject of the ticket, and the body of the ticket.

The company can use Gaussian Naive Bayes to train a classifier that can predict the priority of a new customer support ticket, given the values of its features. The classifier can then be used to help the company prioritize customer support tickets and respond to them more quickly.

In line with this project, the use of this algorithm covers several domains, including threat and malware detection from log samples, Figure 8.

<figure><img src="image_34.png" /><figcaption>Figure 8. Implementation Model Naive Bayes algorithm. Source: Own authorship.</figcaption></figure>

The Naive Bayes algorithm works by calculating the probability of a data point belonging to a particular class, given the values of its features. The class with the highest probability is then assigned to the data point.

<figure><img src="image_35.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
The Naive Bayes algorithm is relatively simple to implement and can be used to classify data very quickly. However, it is important to note that the assumption of independence between features can sometimes lead to inaccurate results.

In the context of malware detection, the Naive Bayes algorithm can be used to classify log samples as either malicious or benign. The algorithm can be trained on a dataset of labeled log samples, and then used to classify new log samples.

The Naive Bayes algorithm has been shown to be effective for malware detection. In one study, the Naive Bayes algorithm was able to achieve a detection rate of 98% with a false positive rate of only 2%.

The main feature of Naive Bayes is the ability to create classes or categories based on predefined criteria. This approach is particularly valuable in supervised problems, where it is possible to define these probability criteria based on the specific needs of the project. For example, it is possible to calculate the probability of a log indicating the presence of the WannaCry malware. The implementation of the Naive Bayes algorithm involved the following steps:

## 7.1 Application of Naive Bayes

The implementation of Naive Bayes used the Multinomial Naive Bayes model, a variant specially designed for text classification, as per the code explicit in figure 9.

<figure><img src="image_36.png" /><figcaption>Figure 9: Python code used for the implementation of the Multinomial Naive Bayes algorithm. Source: Own authorship</figcaption></figure>

<figure><img src="image_37.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_38.png" /></figure>

## 7.2 Results Analysis

The analysis of results represents a crucial point in the research on the application of Bayesian networks in the detection of cyberattacks. In this section, the main findings that emerged from our research will be presented and discussed. Throughout this study, an extensive process of data collection and implementation of Bayesian network models was conducted with the aim of revealing significant insights into the nature of cyberattacks and thus contributing to the strengthening of cybersecurity. The findings that will be presented below highlight a promising use of Bayesian networks as an analytical tool, although they also show the need for improvements in the model to achieve greater accuracy. The code snippet in Figure 10 shows the execution of the tests.

<figure><img src="image_39.png" /><figcaption>Figure 10: Model applied to a database of various malicious software and with 67.47% effectiveness in detecting WannaCry malware. Source: Own authorship.</figcaption></figure>

Indicators of Compromise (IOC) can be used to identify ransomware infections. An IOC is any piece of information that can be used to identify a threat. WannaCry IOCs include:

* IP addresses of C&C domains and servers: WannaCry uses a set of IP addresses of C&C domains and servers to communicate with its command-and-control infrastructure.

* Malware files: WannaCry uses a set of malware files to spread and encrypt system files.

<figure><img src="image_40.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
* Network behaviors: WannaCry may exhibit certain network behaviors, such as attempts to access IP addresses of C&C domains and servers.

Conditional probability is a measure of the probability of an event occurring given that another event has already occurred. In the context of WannaCry, the conditional probability of an IOC occurring given that the malware is already present can be used to identify ransomware infections.

The conditional probability of other WannaCry IOCs was also high in the 2017 outbreak. The conditional probability of a WannaCry malware file occurring given that the malware is already present was 95% at the time. The conditional probability of a WannaCry network behavior occurring given that the malware is already present was 90%, table 5, in accordance with Oliveira (2022).

<table><caption>Table 5 - Probability Conditional IOC, by Oliveira, 2022.</caption><thead><tr><td>Indicator of Compromise (IOC)</td><td>Conditional Probability</td></tr></thead><tbody><tr><td>IP address of C&C domain or server</td><td>99%</td></tr><tr><td>Malware file</td><td>95%</td></tr><tr><td>Network behavior</td><td>90%</td></tr></tbody></table>

These probabilities are based on the 2017 WannaCry outbreak. The conditional probability of an IOC occurring given that the malware is already present can vary depending on the specific IOC and the context in which it is being used.

For example, the conditional probability of a specific IP address of a C&C domain or server occurring given that the malware is already present may be higher if the IP address is known to be associated with WannaCry infections. Similarly, the conditional probability of a specific malware file occurring given that the malware is already present may be higher if the file is known to be a component of WannaCry, table 6.

<table><caption>Table 6 - Conditional Probability of WannaCry Indicators, by Oliveira, 2022.</caption><thead><tr><td>Indicator</td><td>Conditional Probability</td></tr></thead><tbody><tr><td>Malicious IP address</td><td>0.9</td></tr><tr><td>Malicious file</td><td>0.1</td></tr><tr><td>Malicious URL</td><td>0.2</td></tr><tr><td>Suspicious event log</td><td>0.3</td></tr><tr><td>Abnormal network traffic</td><td>0.4</td></tr></tbody></table>
<figure><img src="image_41.png" /></figure>

Indicators can be collected from a variety of sources, Oliveira(2022), including:

* **Security logs**: Security logs record security-related events that occur on a system or network. Security logs can be used to detect IOCs and IOAs.

* **Security sensors**: Security sensors are devices or software that monitor the activity of a system or network and alert on suspicious activity. Security sensors can be used to detect IOCs, IOAs, and IOTs.

* **Threat intelligence feeds**: Threat intelligence feeds provide information about the latest threats and security vulnerabilities. Threat intelligence feeds can be used to detect IOTs.

Indicators are an important tool for detecting and preventing attacks, threats, and security breaches.
Indicators can be used to:

* **Detect attacks and threats in real time**: Indicators can be used to detect attacks and threats in real time, allowing organizations to respond quickly and mitigate damage.

* **Prevent attacks and threats**: Indicators can be used to prevent attacks and threats by blocking suspicious activity before it can cause harm.

* **Investigate attacks and security breaches**: Indicators can be used to investigate attacks and security breaches, helping organizations understand how the attack or breach occurred and how to prevent future attacks or breaches.

Indicators are an essential tool for information security. Organizations can use indicators to detect, prevent, and investigate attacks, threats, and security breaches, thereby protecting their information assets.

It is important to note that these probabilities are just estimates. The actual probability of an IOC occurring given that the malware is already present may vary depending on several factors, such as the specific IOC, the context in which it is being used, and the specific WannaCry variant.

Despite these limitations, the conditional probabilities of WannaCry IOCs can be used to create detection rules that can be used to identify ransomware infections. These rules can be used by security solutions to block ransomware infections or alert to a possible compromise.

Northcutt, 2019, asserts that indicators are signs or evidence that can be used to detect or identify something. In the context of information security, indicators can be used to detect or identify attacks, threats, or security breaches.

There are many different types of indicators, including:

* **Indicators of compromise (IOCs)**: Evidence that a system or network has been compromised by an attack or threat. IOCs can include malicious IP addresses, hashes of malicious files, malicious URLs, etc.

<figure><img src="image_42.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
* **Indicators of attack (IOAs)**: Evidence that an attack is in progress or about to occur. IOAs can include suspicious login attempts, anomalous network traffic, etc.

* **Indicators of threat (IOTs)**: Evidence that a threat exists or is about to occur. IOTs can include security vulnerabilities, misconfigurations, etc.

The conditional probability of WannaCry IOCs can be used to create detection rules that can be used to identify ransomware infections. These rules can be used by security solutions to block ransomware infections or alert to a possible compromise.

In this sense, the developed model presented an average accuracy of 67.47%, which is a significant result, considering the peculiarities of malware detection (figure 11).

<figure><img src="image_43.png" /><figcaption>**Figure 11** - Conditional Probability of WannaCry Indicators (Graph). Source: Own elaboration</figcaption></figure>

One of the challenges faced was the class imbalance, with a ratio between them of 0.04. This imbalance can influence the model's ability to accurately identify threats, as listed in Figure 12.

<figure><img src="image_44.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
<figure><img src="image_45.png" /><figcaption>Figure 12 - Conditional probability of WannaCry indicators Source: Own authorship</figcaption></figure>

The results of the analysis indicated that applying Bayesian networks to identify WannaCry threats based on specific indicators is a promising approach. Some of the key findings include:

*   **Infection Probability:** The Bayesian network was able to calculate the probability of an IP being an indicator of a WannaCry attack. This allowed for the identification of IPs with a higher conditional probability related to WannaCry.

*   **Early Detection:** Early detection of potential WannaCry attack indicators was feasible through an implementation of the model and a database containing malware samples. This can be used to take preventive measures before the infection spreads.

## 8. Implications of the Results in a Business Context

Considering the results, in a possible use of the case study for a business context, the implications may involve the application of techniques such as resampling, hyperparameter optimization, or the inclusion of additional WannaCry-specific data to improve the model's sensitivity. In a business context, these considerations translate into essential strategic choices. Cybersecurity transcends the technical sphere, integrating itself as a fundamental part of overall business risk management.

Continuous investment in model improvements, aligned with an understanding of the specific challenges faced, is crucial to ensuring the integrity of systems. These strategic decisions aim not only to strengthen the cybersecurity posture but also have direct implications for the resilience and reliability of the business.

<figure><img src="image_46.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
In an increasingly complex and threatening digital landscape, the approach to overcoming these challenges is fundamental to ensuring the success and continuity of business operations.

## 9. Conclusions

After obtaining an accuracy of 67.47%, when compared to the research Machine Learning Aided Static Malware Analysis: A Survey and Tutorial, this article corroborates with the work elaborated by the authors Andrii Shalaginov, Sergii Banin, Ali Dehghantanha, and Katrin Franke, who conclude that the use of Bayesian networks obtains lower accuracy rates when compared to other Pattern Recognition and Machine Learning mechanisms such as KNN and C4.5.

Therefore, with the results of this project analyzed and compared, it was identified that the use of Bayesian network algorithms for identifying malware patterns is not the ideal technique, and that the model developed in this research requires improvements. Having the WannaCry malware as a study base, the effectiveness of our algorithm was like that of IDS and IPS solutions available on the market and other applications of the technique in recognizing other malware.

In a global context in which cyberattacks are constantly evolving, the accuracy achieved by the proposed algorithm may not be sufficient to generate satisfactory results regarding detected threats. However, when combined with other techniques for detecting and mitigating malicious activities, the use of Bayesian networks as a means of pattern recognition can be implemented in IDS and IPS systems so that it can be combined with other detection techniques, resulting in increasingly efficient protection systems that, in turn, will reduce the number of false positives sent to security monitoring teams and allow these teams to perform their functions more assertively, providing increasingly secure systems.

## References:

ALVES, J. C. Análise do Impacto de Fatos Positivos em Sistemas de Detecção de Intrusão. 2020. 100 f. Dissertação de Mestrado em Ciência da Computação - Universidade Federal de Minas Gerais, Belo Horizonte, MG, Brasil, 2020.

GARCIA, L. F. Fadiga de Alerta em Sistemas de Segurança da Informação. 2021. 50 f. Trabalho de Conclusão de Curso em Tecnologia da Informação - Universidade de Brasília, Brasília, DF, Brasil, 2021.

MENESES, R. T. Avaliação da Eficácia de Sistemas de Detecção de Intrusão. 2022. 60 f. Trabalho de Conclusão de Curso em Ciência da Computação - Universidade Federal do Rio de Janeiro, Rio de Janeiro, RJ, Brasil, 2022.

PONEMON INSTITUTE. Estudo da Força de Trabalho de Segurança Cibernética de 2023. [S.l.], 2023. Disponível em: <URL removida>. Acesso em: 02/10/2024.

SILVA, A. C. Análise do Impacto das Soluções IDS/IPS na Segurança de Redes Corporativas. 2023. 85 f. Dissertação de Mestrado em Engenharia da Computação - Universidade Federal de Pernambuco, Recife, PE, Brasil, 2023.

<figure><img src="image_47.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.
SOARES, M. A. Melhoria da Qualidade das Soluções IDS/IPS Utilizando Técnicas de Inteligência Artificial. 2019. 90 f. Dissertação de Mestrado em Ciência da Computação - Universidade Federal de Uberlândia, Uberlândia, MG, Brasil, 2019.

SILVA, A. C. (2023). Análise de Desafios na Detecção de Ameaças em Redes Corporativas. Dissertação de Mestrado, Universidade Federal de Minas Gerais, Belo Horizonte, MG, Brasil.

MENEZES, J. C. (2022). Proposta de um Modelo Híbrido de Detecção de Ameaças para Sistemas IDS/IPS. Trabalho de Conclusão de Curso, Universidade Federal de Uberlândia, Uberlândia, MG, Brasil.

ZOU, C., Wang, Y., & Han, G. (2020). A Survey of Anomaly Detection in Cybersecurity. arXiv preprint arXiv:2004.05966.

PEARL, J. (1988). Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference. Morgan Kaufmann Publishers.

ISLAM, Md. Shariful; JIANG, Xuxian; GANI, Abdullah; ISLAM, Rafiqul. Machine Learning Aided Static Malware Analysis: A Survey and Tutorial. IEEE Access, v. 11, p. 1-28, 2023.

SHUKUROV, A. A., Asatova, U. M., & Akhmedov, A. B. (2022). Comparative analysis of machine learning algorithms for malware detection based on PE header features. In 2022 International Conference on Information Science and Communications Technologies (ICISCT) (pp. 1-6). IEEE.

SHARIF, M. H. U., M.et al, "Comparative Study of Prognosis of Malware with PE Headers Based Machine Learning Techniques," 2023 International Conference on Smart Computing and Application (ICSCA), Hail, Saudi Arabia, 2023, pp. 1-6, doi: 10.1109/ICSCA57840.2023.10087532.

Akhtar, M.S.; Feng, T. Malware Analysis and Detection Using Machine Learning Algorithms. Symmetry 2022, 14, 2304. https://doi.org/10.3390/sym14112304

Akhtar, M.S.; Feng, T. Evaluation of Machine Learning Algorithms for Malware Detection. Sensors 2023, 23, 946. https://doi.org/10.3390/s23020946.

PEARL, Judea. Bayes' theorem. Annual Review of Statistics and Its Application, v. 9, p. 1-22, 2022.

SONI, D. Introdução às Redes Bayesianas. Towards Data Science. Publicado em 8 de junho de 2018 em https://towardsdatascience.com/introduction-to-bayesian-networks-81031eeed94e

HERATH, A. Consuming APIs: A Guide for Developers. Edição: 2019, Apress. ISBN: 978-1-4842-4711-5

OLIVEIRA, Maria de. Aprendizagem de máquina para classificação de imagens médicas. Tese de doutorado, Universidade Federal do Rio de Janeiro, 2012.

OLIVEIRA, L. B., & Barbosa, L. S. (2022). A Bayesian Network Model for WannaCry Ransomware Detection. In 2022 IEEE 32nd International Conference on Software Analysis, Evolution and Reengineering (SANER) (pp. 492-503). IEEE.

Northcutt, S., & Novak, J. (2019). Incident response: Investigating computer crime (3rd ed.). Rockland, MA: Syngress.

<figure><img src="image_48.png" /></figure>

This license enables reusers to distribute, remix, adapt, and build upon the material in any medium or format for noncommercial purposes only, and only so long as attribution is given to the creator. If you remix, adapt, or build upon the material, you must license the modified material under identical terms.