A SIEM and Multiple Analysis Software Integrated Malware Detection Approach

The organization’s IT systems, especially IT and OT combined systems have a large surface exposed to sophisticated cyber-attacks, such as Advanced Persistent Threats (APT) and malware variants. To defend against those cyber attackers, Security Information and Event Management (SIEM) technologies could be leveraged. SIEM is a security solution that helps organizations recognize potential security threats and vulnerabilities, detects user behaviour anomalies, and provides an incident response. However, the existing SIEMs are insufficient to effectively counteract malware attacks, and more functionalities need to be developed and enhanced. There are analysis software approaches that statically or dynamically analyze suspicious files to detect malware, such as VirusTotal, Capa, Yara, and machine learning (ML) algorithms. In this work, we integrate an open-source SIEM tool with multiple analysis software, so that the malware analysis can be conducted from different aspects, i.e., from log data, static and dynamic code analysis, and behaviour analysis. And we demonstrate the enhanced real-time malware detection capability and performance.