Behavioral Malware Detection for Modern Networking Environments Based on Multiple Threat Data Sources

Abstract

There is a growing need for adaptable and dynamic security solutions. Cyber Threat Intelligence plays a crucial role in mitigating threats, enabling the collection and analysis of information about digital threats, from which this data can be used to address security incidents. In this context, this article presents a solution based on Cyber Threat Intelligence and Machine Learning for detecting files with malicious behavior. The Machine Learning model is fed with data collected from Cyber Threat Intelligence databases (VirusTotal, Hybrid-Analysis, and Triage). The data obtained, used in the Machine Learning models, provides behavioral information that is legitimate a priori, but whose frequency or sequence of actions can be strong indicators of a malicious file. The results show that the solution can accurately categorize which files are malicious and which are not.