Deep Learning Methods for the Analysis of Cyber Behaviour and Detection of Cyber Risk (EPSRC ICASE / AIRBUS)

Automatic malware detection is necessary to handle the volume of new samples discovered daily. Malware authors attempt to evade automatic detection by manipulating code but find it difficult to alter the behaviour of malware as this usually intrinsic to the core functionality of the malware. Behavioural malware detection using deep neural networks gives state of the art detection accuracy but is costly in terms of time and computational resources, making it unsuitable for front-line detection on endpoints and better suited to non-time critical analysis.

The project investigates how deep learning behavioural detection mechanisms could be used for endpoint protection as part of the front-line of defence. The research will explore ways to reduce the time and computational overheads of detection. The temporal reduction will examine the necessity of time spent collecting data from malware as well as the time required for inference from the deep learning model. The computational overhead reduction will consider the architecture of the deep learning models, data collection and hardware components. Throughout the experiments it will be important to consider real damage prevention to the user and any vulnerabilities of the proposed solution, previous work has not combined practical user benefits with behavioural endpoint protection. Relevant research areas include digital signal processing, operational research, and artificial intelligence technologies.