Malware triage for early identification of Advanced Persistent Threat
  activities
  In the last decade, a new class of cyber-threats has emerged. This new
cybersecurity adversary is known with the name of "Advanced Persistent Threat"
(APT) and is referred to different organizations that in the last years have
been "in the center of the eye" due to multiple dangerous and effective attacks
targeting financial and politic, news headlines, embassies, critical
infrastructures, TV programs, etc. In order to early identify APT related
malware, a semi-automatic approach for malware samples analysis is needed. In
our previous work we introduced a "malware triage" step for a semi-automatic
malware analysis architecture. This step has the duty to analyze as fast as
possible new incoming samples and to immediately dispatch the ones that deserve
a deeper analysis, among all the malware delivered per day in the cyber-space,
the ones that really worth to be further examined by analysts. Our paper
focuses on malware developed by APTs, and we build our knowledge base, used in
the triage, on known APTs obtained from publicly available reports. In order to
have the triage as fast as possible, we only rely on static malware features,
that can be extracted with negligible delay, and use machine learning
techniques for the identification. In this work we move from multiclass
classification to a group of oneclass classifier, which simplify the training
and allows higher modularity. The results of the proposed framework highlight
high performances, reaching a precision of 100% and an accuracy over 95%
