Got a talking point for VB2024?... Why not turn it into a poster?

Malware Spread Analysis Using a Time Evolution Model

Ferenc Leitold, Óbuda University

• Objective: The paper proposes a Time Evolution Model to analyze the spread properties of malicious samples. The model can assist in more accurately determining the propagation properties of malware, supporting the development of more effective cybersecurity defense strategies.
• Methodology: The model tracks the time-dependent ratio of "Detected" decisions (infected) over time by different malware protections. It uses a nonlinear curve fitting method to describe how the detection ratio changes over time for a specific sample.
• Core parameters:
  • Asymptote (α1): Indicates if a sample is malicious or not.
  • Start Time (α3): Helps classify malware as "new" or "old."
  • Slope (α1 * α2): Represents the spread speed of a malware infection.

• Practical application: The model was tested on over 1,000 malicious samples from the AMTSO RTTL database, demonstrating how it can classify samples.
• Use cases:
  • Prioritization of protection tasks in IT infrastructures: The Time Evolution Model helps cybersecurity teams prioritize which malware to focus on by identifying the most rapidly spreading threats.
  • Selection of relevant malware samples for testing: By analyzing the spread characteristics of different malware, the model aids in selecting the most representative samples for testing security systems.
  • Estimating trends in malware spread and behavior over time: The model enables security experts to track how malware spreads over time, allowing for better predictions of future cyber threat trends.
  • Qualification of threat intelligence feeds: The Time Evolution Model assesses the accuracy and relevance of threat intelligence feeds, helping organizations choose the most reliable sources for current malware threats.
• Accuracy of the model: Early analysis of malware samples (closer to their appearance) yields more accurate results, particularly regarding the malware's age and spreading speed.

Lost in Translation? Not Anymore! The Role of Fine-Tuned LLMs in Translation

Veronica Valeros, Czech Technical University in Prague

The escalation of the Russia-Ukraine war in 2022 has brought with it a large number of cyber-attacks. The war fuelled and instigated cyber-hacktivist groups to join in, which in turn influenced and sustained more cyber operations. Many cyber-hacktivist groups quickly pledged allegiance to one side or the other, generating a massive increase in cyber attacks.

Given the participation of cyber-hacktivists in the war, it has become paramount to interpret their online campaigns in a time-efficient manner in order to better understand their tactics, motivations, and alliances. A better understanding of this evolving landscape contributes to the implementation of effective countermeasures. This often involves translating communications into English for processing, interpreting, and generating timely intelligence. The problem is that translation is hard. Human translation is slow, expensive, and scarce. Machine translation is inaccurate and biased.

We fine-tuned Large Language Models (LLM) to generate translations that can accurately capture the nuances of cybercrime language. We apply our technique to public chats from the NoName057(16) Russian-speaking hacktivist group.

Our results show that our fine-tuned LLM model is better, faster, more accurate, and able to capture nuances of the language. Our method shows it is possible to achieve high-fidelity translations and significantly reduce costs by a factor ranging from 430 to 23,000 compared to a human translator.

This presentation will show the process of generating a fine-tuned model that can accurately translate from Russian to English. We will show the results of the analysis and a comparison with other common machine translation techniques such as DeepL and Google Translate. The presentation will show examples of successful and unsuccessful translations, how the fine-tuned LLM model helps, and what can be achieved with a powerful translation mechanism like the one proposed.

This tool will introduce two new tools for the community: one for the automatic collection of Telegram chats from hacktivist groups and one for the automatic translation of messages using LLMs.