Utilizarea tehnicilor inteligenței artificiale în analiza malware / Using artificial intelligence techniques for malware analysis

In a difficult economic, social, geo-political and health context in which the whole world finds itself, cyber threats have gained significant importance due to the complexity of attacks and the high impact they have especially on organizations, but also on individual users. The purpose of this doctoral thesis is to analyze the current challenges in the field of cyber security, both at a technical and organizational level: based on these, I developed, tested, and proposed solutions to improve the capabilities and processes that are part of the cyber defense strategy. One of the main objectives of the doctoral thesis was to identify detection and analysis methods of cyber attacks and malware where Artificial Intelligence techniques can be applied. This work is focused on the analysis and implementation of a series of solutions based on the fundamental principles of intelligent systems with the aim of improving their efficiency in terms of malware detection and reducing analysis time. Among the original contributions presented in the thesis is a dynamic malware analysis solution that uses a neural network to classify running processes and identify attack chains. I proposed a solution to detect phishing websites that aim to steal authentication details based on similarity analysis between the legitimate website and a suspicious one. Also, a honeypot solution for ransomware detection was developed and tested, with a dual role: detection (consisting of a file sharing service that is continuously monitored using heuristic rules) and analysis (based on the recorded events during infection the source can be identified).