Original title: Automatická detekce aktivity malwaru v lokálních sítích
Translated title: Automated Detection of Malware Activity on Local Networks
Authors: Pap, Adam ; Regéciová, Dominika (referee) ; Ryšavý, Ondřej (advisor)
Document type: Bachelor's theses
Year: 2024
Language: slo
Publisher: Vysoké učení technické v Brně. Fakulta informačních technologií
Abstract: [slo] [eng]
Cieľom tejto práce je analyzovať sieťovú komunikáciu malware a následne identifikovať vhodné významné vlastnosti, ktoré by umožnili vytvoriť vhodnú metódu na jeho detekciu. Súčasťou riešenia práce bolo aj vytvorenie dátovej sady z ktorej sa extrahovali IoC jednotlivých malware rodín. Tieto IoC boli následne overené cez platformu AlienVault OTX, z dôvodu overenia ich relevantnosti. Pre vyhodnotenie boli použité metriky ako miera falošnej pozitivity, presnosť a senzitivita. Na testovacích dátach oba IoC modely, vytvorených z dátových sád, dosiahli presnosť 99.337% a 94.732% pre dátovú sadu č. 2. IoC modely sady č. 1 v reálnej prevádzke falošne klasifikovali 3.03% komunikačných okien ako škodlivých. IoC modely sady č. 2 klasifikovali 5.66% okien škodlivými. Následne boli v testovacom prostredí spustené vzorky rôznych malware rodín, kde IoC modely sady č. 1 klasifikovali 7.14% okien škodlivými. Modely sady č. 2 klasifikovali 15.79%. The aim of this work is to analyze the network communication of malware and then identify suitable significant features that would allow to develop a suitable method for its detection. As part of the solution of the thesis, a dataset was created from which an IoC for each malware family were extracted. These IoCs were then validated through the AlienVault OTX platform, in order to verify their relevance. Metrics such as false positive rate, accuracy and sensitivity were used for evaluation. On the test data, the two IoC models created from the datasets achieved an accuracy of 99.337% and 94.732% for dataset 1 and 2, respectively. The IoC models of dataset No. 1 falsely classified 3.03% of communication windows as malicious in real communication. IoC models of set No. 2 classified 5.66% as malicious. After the samples of different malware families were run on the machine, the IoC models of set No. 1 classified 7.14% of the windows as malicious. Set No. 2 models classified 15.79%.
Keywords: dataset; fuzzy set; indicator of compromise; local network; malware; malware family; network communication

Institution: Brno University of Technology (web)
Document availability information: Fulltext is available in the Brno University of Technology Digital Library.
Original record: https://hdl.handle.net/11012/246961

Permalink: http://www.nusl.cz/ntk/nusl-618145


The record appears in these collections:
Universities and colleges > Public universities > Brno University of Technology
Academic theses (ETDs) > Bachelor's theses