MalwareTextDB: A Database for Annotated Malware Articles

Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics, pages 1557–1567 Vancouver, Canada, July 30 - August 4, 2017. c⃝2017 Association for Computational Linguistics https://doi.org/10.18653/v1/P17-1143 Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics, pages 1557–1567 Vancouver, Canada, July 30 - August 4, 2017. c⃝2017 Association for Computational Linguistics https://doi.org/10.18653/v1/P17-1143 MalwareTextDB: A Database for Annotated Malware Articles Swee Kiat Lim and Aldrian Obaja Muis and Wei Lu Singapore University of Technology and Design 8 Somapah Road, Singapore, 487372 limsweekiat@gmail.com, {aldrian_muis,luwei}@sutd.edu.sg Chen Hui Ong DSO National Laboratories 20 Science Park Drive, Singapore, 118230 ochenhui@dso.org.sg Abstract Cybersecurity risks and malware threats are becoming increasingly dangerous and common. Despite the severity of the prob- lem, there has been few NLP efforts fo- cused on tackling cybersecurity. In this paper, we discuss the construction of a new database for annotated malware texts. An annotation framework is intro- duced based around the MAEC vocabu- lary for defining malware characteristics, along with a database consisting of 39 an- notated APT reports with a total of 6,819 sentences. We also use the database to construct models that can potentially help cybersecurity researchers in their data col- lection and analytics efforts. 1 Introduction In 2010, the malware known as Stuxnet physically damaged centrifuges in Iranian nuclear facilities (Langner, 2011). More recently in 2016, a botnet known as Mirai used infected Internet of Things (IoT) devices to conduct large-scale Distributed Denial of Service (DDoS) attacks and disabled In- ternet access for millions of users in the US West Coast (US-CERT, 2016). These are only two cases in a long list ranging from ransomeware on per- sonal laptops (Andronio et al., 2015) to taking over control of moving cars (Checkoway et al., 2011). Attacks such as these are likely to become increas- ingly frequent and dangerous as more devices and facilities become connected and digitized. Recently, cybersecurity defense has also been recognized as one of the “problem areas likely to be important both for advancing AI and for Figure 1: Annotated sentence and sentence frag- ment from MalwareTextDB. Such annotations provide semantic-level information to the text. its long-run impact on society" (Sutskever et al., 2016). In particular, we feel that natural language processing (NLP) has the potential for substantial contribution in cybersecurity and that this is a crit- ical research area given the urgency and risks in- volved. There exists a large repository of malware- related texts online, such as detailed malware re- ports by various cybersecurity agencies such as Symantec (DiMaggio, 2015) and Cylance (Gross, 2016) and in various blog posts. Cybersecurity researchers often consume such texts in the pro- cess of data collection. However, the sheer vol- ume and diversity of these texts make it difficult for researchers to quickly obtain useful informa- tion. A potential application of NLP can be to quickly highlight critical information from these texts, such as the specific actions taken by a cer- tain malware. This can help researchers quickly understand the capabilities of a specific malware …

Content truncated to 500 words