Threat Behavior Textual Search by Attention Graph Isomorphism (2024)

Abstract: Cyber attacks cause over $1 trillion loss every year. An important task for cyber security analysts is attack forensics. It entails understanding malware behaviors and attack origins. However, existing automated or manual malware analysis can only disclose a subset of behaviors due to inherent difficulties (e.g., malware cloaking and obfuscation). As such, analysts often resort to text search techniques to identify existing malware reports based on the symptoms they observe, exploiting the fact that malware samples share a lot of similarity, especially those from the same origin. In this paper, we propose a novel malware behavior search technique that is based on graph isomorphism at the attention layers of Transformer models. We also compose a large dataset collected from various agencies to facilitate such research.Our technique outperforms state-of-the-art methods, such as those based on sentence embeddings and keywords by 6-14%. In the case study of 10 real-world malwares, our technique can correctly attribute 8 of them to their ground truth origins while using Google only works for 3 cases.

## introduction cyber-attacks are a prominent threat to our daily life, causing over $1 trillion loss every year. defending and mitigating cyber-attacks are hence critical. an important task in the arms race is attack forensics, which aims to determine malware behaviors, damages, and origins. it usually starts with an attack instance, e.g., a malware sample captured in the wild. the analysts use tools such as ida @xcite to inspect its code body, and sand-boxing techniques such as cuckoo @xcite to execute it and observe its runtime behaviors. attack forensics are important because the results can be used to assess damages and prevent future attacks. however, malware often employs sophisticated self-protection such as obfuscation @xcite that changes code body to make it difficult to understand and/or masquerade a benign application, and cloaking that conceals malicious payload until certain (attack) conditions are satisfied. as a result, analysts usually can only disclose a part of malware behaviors. they hence heavily rely on text search to find existing related malware reports. such search is usually driven by the observed behaviors such as sabotage, data exfiltration (regarding how they are performed?). the rationale is that cyber-attacks become increasingly organized (e.g., sponsored at a state-level), showing a substantial level of commonality in terms of the exploits used (i.e., bugs in target systems that allow the malware to penetrate), the payloads delivered, and their objectives, especially for those launched by a same threat actor (malpedia) (i.e., an adversary or an organization of adversaries). as such, one can predict a new malware's full behaviors from reports of existing malware samples that share some commonality with the new sample. in fact, major security vendors have published a large volume of malware analysis reports. while they have the great potential to provide collective intelligence for future analysis, there has been an intrinsic barrier to fully leveraging such knowledge, namely, these threat reports are written in unstructured and informal natural languages. since anyone can contribute such reports, it is difficult to standardize them. therefore, the key problem is a specialized text search challenge, which is called cyber threat intelligence (cti) search following the terminology used in the domain. cti search poses two main challenges; (i) supervised-learning is hardly feasible due to the lack of labeled datasets, and (ii) existing pre-trained general-purpose language models cannot effectively capture domain specific semantics. sometimes, small changes for a generalpurpose language model denote substantial semantic differences in cti. for example, a "file" may describe either information stealing ("file to leak the stolen data from the program") or program exploitation ("file to exploit the program for stealing data"). the most popular search method directly uses indicators of compromise (iocs) of the malware sample, e.g., malware file hash @xcite . it is the method used in virustotal (virustotal), a widely used malware analysis platform. although using iocs is precise and free from false positives, it cannot deal with the well known malware mutation problem @xcite in which malware frequently and consistently changes its configurations, payloads, and even attack steps, to evade detection or simply update its functionalities. another method is text similarity based malware behavior search. existing text similarity methods largely fall into two categories, keywords based methods (corley @xcite and sentence embedding based methods @xcite @xcite . the former focuses on domain specific keywords. it cannot effectively extract relations across keywords, which are critical in cti search. in the above example, the keyword "file" needs to be analyzed with the relation of other words (i.e., "leak" or "exploit") -keywords-based search (i.e., "steal", "program", "data") will cause misunderstanding. in contrast, directly using embeddings tends to be unnecessarily distracted by the words that are not critical to cti search. we propose a novel cti search technique. we collect a large repository of cti reports from multiple agencies such as kaspersky, symantec and macafee. specifically, mitre att&ck (mitre attack) is a widely-known knowledge base of adversary techniques (i.e., behaviors) based on realworld malware observations. the repo covers reports in the past 20 years. we then use a maskedlanguage model (mlm) based on transformer to perform unsupervised learning on the dataset. we observe that the language model can pay special attention to ioc related words, and more importantly, their correlations. after training, instead of using the pre-trained embeddings, which are noisy due to the large natural language vocabulary, we construct a attention graph in which a node is a word token and an edge is introduced between two nodes when their attention is larger than a threshold. we then use graph similarity to determine cti report similarity. we make the following contributions. our method consistently outperforms these baselines. ## motivation a real-world event in 2019 on a nuclear power plant in india (india today, 2019) illustrates how an information retrieval (i.e., our system) contributes to cyberattack investigations. it is a multistage attack that first penetrates some computers on the power-plant's network, leveraging a zeroday code vulnerability (e.g., a bug in browser) and then laid low and silently compromise more systems leveraging normal functionalities. the process may take days or even weeks. the payload was finally delivered, 3-5 days after the initial penetration, accessing the nuclear plant's confidential data. such complex and multi-staged attacks are also called advanced persistent threat (apt) @xcite . assume a few days after the attack was initiated, security analysts noticed some system anomaly. further assume they acquired an attack artifact, which is the executable malware file used in the first penetration step. from the file, analysts acquired the hash of the malware bfb39f486372a509...0364 and a few malware behaviors using a sandbox tool, namely, (b-1) "use a dropper that has encrypted payload", (b-2) "list all however, from these symptoms, the analysts can hardly determine the objective and scope of the attack. since the power plant is critical infrastructure, they need answers to a number of questions, for example, what is the attack origin (is it from a major known threat actor)? and what are the attacker's ultimate interests (e.g., infrastructure sabotage and confidential information leak)? critical decisions need to be made based on the answers to these questions. the collected evidence is insufficient to answer these questions, which is very typical due to the inherent difficulties in malware analysis. the analysts usually resort to cti search in our case, assume they first looked up the file hash on virustotal to check if the same attack has been conducted in the past. however, the attack was unique in 2019 and hence virustotal returned no match. in fact, the malware was first submitted to virustotal on october 28, 2019, one month after the initial attack. then in step 2 , the analysts tried to find previous cti reports using the behaviors, that is, b-1, b-2, and b-3. as the behaviors were written in natural language, they needed to rely on text search methods. assume they used google and the textual descriptions of the behaviors. however, the search results were not informative. observe most of the retrieved items are not even semantically related. the semantically related items are in fact not related to the attack at all (refer to appendix a.4). our method. assume that analysts had our search technique in 2019. searching the three behaviors using our method, the analysts managed to retrieve 3 malware reports (i.e., a-1, a-2 and a-3) dated before the attack time which are all conducted by lazarus group within last 2 years (see top three boxes in figure 1 ). the analysts hence suspected the origin of attack was the lazarus group (step 4 ). more importantly, recent threat intelligence article (a-4 (zdnet, 2019)) says that lazarus groups recently perform the following attacks: (i) browser history collection, (ii) keylogging and (iii) disk-drive scrapping (step 5 ). therefore, the system administrator could employ the corresponding countermeasures (step 6 ). one month after the attack, real forensics reports were produced for the attack, named dtrack (economictimes, 2019). they indicated that the attack mainly focused on stealing data from the keystroke (i.e., keyboard), monitoring web-browsing history, data dump from local disk. the information could have been disclosed by our technique much earlier if it was available at that time. ## related work cyber threat intelligence search. the most popular cti search method uses ioc information @xcite . existing work usually formulates the challenge as a named entity recognition (ner) problem, aiming to identify malware artifacts (e.g., ip address and file hash) from natural language documents @xcite . attack ontology was proposed in @xcite , aiming to formalize malware behaviors. researchers have proposed to extend the datasources of threat intelligence, such as twitter or @xcite @xcite . text similarity. similarly analysis is the key technique behind text search, which has been well studied @xcite @xcite @xcite @xcite @xcite . basically, these approaches try to capture the common keywords between two texts. some work adopts several optimization techniques; using wordweighting (corley and @xcite @xcite with idf-score @xcite , leveraging external knowledge @xcite and use of word similarity methods @xcite @xcite . in the cti search, a knowledge-based approach is limited due to absence of such resources (e.g., wordnet @xcite ). meanwhile, word similarity and weighting are limited to the corpus-based approaches which are included as our baselines (corley and @xcite . recently, with the advances in ai, deep learning based approaches become increasingly popular @xcite @xcite @xcite @xcite . specifically, embeddings are broadly in use with a number of popular training schemes: continuous bag of words (cbow) based training (e.g., doc2vec @xcite ) and masked language models (mlm) based training @xcite 4 design cti reports have domain specific semantics. for example, 'ip' and 'network' have similar meanings, 'drop' and 'payload' have strong correlations. such semantics can hardly be captured by general-purpose language models. this challenge can be overcome using domain specific corpus during training. therefore, a straightforward proposal is to use masked language model to train on a large corpus of cti reports and then use sentence embeddings in cti search. specifically, a malware ioc is described by some sentence(s). the search can simply look for cti reports that contain similar sentence embeddings. however, such a proposal can hardly work because distinct behaviors by small nuance differences between b-1, i.e., "use a dropper that has encrypted payload" and an entirely different behavior such as "drops an encrypted payload" will not be captured by embedding techniques. as of its ramifications, our later evaluation shows lower precision (i.e., false positives) by embedding techniques ( we observe that the attention mechanism in transformer models can capture (domain specific) semantic correlations between words. for example, there are strong correlations between 'dropper' and "encrypted payload" in b-1 and two strong corre- to compare attention maps with legacy (syntactic) dependency trees, we revisit two of above sentences with their parse trees (in figure 3 ). it shows that the parser fails to capture the long-distance correlation in a lengthy text (i.e., broken correlation). the ramification is that it may need to include unnecessary words between two, i.e., incurring false positives. also, syntactic relations may cause to explore the obsolete paths (i.e., false incursion). training and use of attentions. the benefit of our method is that the model uses self-supervised training. as myriad of security problems, the lack of labeled dataset crucially harm the model performances. albeit it is feasible to collect a large scale of cti text corpus, we have no supervision for training (i.e., no pairwise ground truth). in this regard, our method fits our domain problem in that it exploits the self-supervised learning. we hence use masked language model with a bert @xcite architecture on the large-scale (8m words) cti corpus (refer to the similarity score of two isomorphic subgraphs g 1 and g 2 is hence computed as follows. implementation. we use 8 layers of multi-head attentions (of size 512) with a dropout on each layer (0.1 probability). preprocessing is largely standard with some domain specific normalization for ioc related artifacts, such as ip. specifically, we feed each cti report under search to the model and acquire the self-attentions at the last layer. for each input text, we construct an attention graph, in which each node denotes a token. an edge is introduced between two nodes when their attention exceeds a threshold of 0.15. in sub-graph matching, we use 2.72, and 0.37 as κ and τ threshold each. ## evaluation to train our models, we have collected 10,544 threat analysis articles from eight major security vendors (refer to ## conclusion we propose a novel cti search method using attention graph isomorphism. we have shown that our method improves the effectiveness of cti search for comparative evaluations. our case study also shows that it drastically improves attack origin identification. our technique can correctly attribute 8 of 10 recent attacks while google only attributes 3.