Heuristic Malware Detection Method Based on Structured CTI Data: A Research Study and Proposal

This article addresses the significant and evolving threat of malware, particularly ransomware, to critical infrastructure sectors such as energy, banking, and food supply. Traditional detection methods that rely on specific indicators of compromise, like file hashes or IP addresses, can be easily circumvented by attackers. This paper presents a novel heuristic approach to malware detection using structured cyber threat intelligence data. By aggregating high-level indicators of compromise such as file modifications, registry key changes, and suspicious network communications, this method aims to identify malicious patterns indicative of malware behavior. The proposed detection system employs advanced machine learning techniques, including graph neural networks, to analyze these aggregated indicators of compromise. This approach enables earlier detection of malware, reduces the mean time to detect breaches, and minimizes false positives. The system utilizes the STIX data format for improved interoperability and analysis of cyber threat intelligence data.