Early Malware Characterization based on Online Social Networks

Online social networks (OSNs) spread information worldwide and in a fast and effective way. Given the terrific number of sources, OSNs can be used for event forecasting and its characterization. Although the vast majority of information is noise, OSNs can be a source of data for the early detection and characterization of malware spreading-this representing a significant advantage for the defense team, which can be informed much in advance of when the malware affects the system. In this paper, we propose an early malware characterization technique that combines statistical analysis with Natural Language Processing (NLP). Using this approach, we analyze various malware behaviors over time and discover their characteristics, such as target system types, target applications, vulnerabilities, locations, propagation scale, etc., in order to appropriately prevent/detect/mitigate their malicious activities and implement suitable actions effectively. We tested and evaluated our approach on a dataset collected from Twitter that includes widespread ransomware indicators. The results show that our approach is effective in early characterizing various types of malware, thus can be considered as one of the first line of defense.