Aleksey Lapshin is CEO of ANY.RUN, interactive malware analysis sandbox that helps companies detect and analyze cyber threats in real-time.
The rise of next-gen AI has brought about a new wave of talks about the demise of thousands of professions. The realm of malware analysis, however, is largely automation-proof. It is a complex and ever-changing field that requires a combination of human skills and machine intelligence.
In this article, I will explain some of the challenges surrounding automating malware analysis and the role of interactive malware analysis, and then offer some insights into how to succeed with interactive malware analysis.
The Challenges Of Automating Malware Analysis
Before exploring interactive malware analysis, let’s look at a few of the challenges that face automating malware analysis:
1. The Need For A Proactive Stance
The realm of cybersecurity is continuously in flux, with fresh attacks emerging rapidly. A quick look at my company’s malware trends for Q1 and Q2 of 2023 shows a fundamental shift in the threat landscape over the course of just six months.
Despite the availability of comprehensive databases of known malware signatures, the possibility of new attacks slipping through the cracks always exists.
To stay ahead of emerging threats, specialists adopt a proactive approach. This involves being on the constant prowl for vulnerabilities that criminals can potentially exploit. While automated solutions can be helpful in this regard, they have their own limitations. One of them is their inability to produce quality insights into the newest threats.
As a result, analysts have to search for fresh information and analyze malware samples that have never been seen before by hand. This process involves collecting data from a wide variety of sources, such as darknet forums and reports put together by digital forensics and incident response (DFIR) teams, which are tough for automated tools to process.
2. The Need For Manual Review
Automated threat detection systems generate hundreds of threat alerts every day, most of which are automatically blocked. At the same time, a certain percentage gets passed down to security analysts for review as a way to identify novel attacks.
This process implies hours of manual work, intuitive decision-making and an in-depth understanding of the context—things that any kind of automation tool cannot fully replicate. Additionally, some analysts may lack the expertise to interpret all of the data provided by automated tools. As a result, manual parsing of machine-generated alerts serves as a major bottleneck in the malware analysis process.
3. The Need For An In-Depth Analysis
Malware can be intentionally difficult to detect, making it challenging to fully comprehend its behavior through automated analysis. Some malware may only be activated under certain circumstances, such as when it is connected to a specific network or when it receives a specific command.
Moreover, automated systems cannot account for the subtleties of human behavior, leaving them vulnerable to malware designed to exploit these weaknesses. This, once again, requires human oversight and understanding of nuances.
The Role Of Interactive Malware Analysis
Interactive malware analysis, offered as part of sandbox solutions, can help bridge this gap by combining automation with the insight of manual investigation:
• Automated tools are adept at detecting malicious code and extracting crucial information.
• Human experts excel in in-depth investigations.
For example, interactive sandboxes can help security teams:
• Address the issue of lack of information on emerging threats by processing large arrays of data. This allows them to offer crucial context information on new malware trends.
• Gain more comprehensive insights into the samples they study and collect the information needed to be prepared for future risks and develop proactive mitigation strategies.
• Accelerate investigations into alerts generated by threat detection systems, letting analysts promptly assess the threat level of any sample using advanced scanning techniques.
On top of that, sandboxes can help professionals examine the most sophisticated samples by providing extra tools for fine-tuning the VM analysis environment and giving analysts the freedom to conduct any manipulation needed to uncover the full capabilities of the malware at hand.
How To Succeed With Interactive Malware Analysis
Interactive malware analysis is not a silver bullet. The services that offer it are just one of many tools that should be used as part of a company’s security stack.
To ensure maximum protection against attacks, multiple technologies must be used—including anti-virus software, an intrusion detection system (IDS) and an intrusion prevention system (IPS)—as well as solutions for more advanced malware analysis, such as debuggers, disassemblers and network packet analyzers, among other tools.
Skipping steps in the threat investigation process can also leave organizations vulnerable. Malware analysis is a challenging task that calls for the expertise of human analysts. Automated tools are useful in detecting known malware but can fall short in identifying advanced and new threats.
Organizations should, therefore, prioritize providing training to their analysts to improve their threat intelligence interpretation skills when adopting solutions that make their work easier, such as interactive malware analysis.
By utilizing a layered security approach, organizations can better detect and respond to threats.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Read the full article here
