Skip to main content

Perceiving Behavior of Cyber Malware with Human-Machine Teaming

  • 1457 Accesses

Part of the Advances in Intelligent Systems and Computing book series (AISC,volume 960)


Cyber malware has evolved from simple hacking programs to highly sophisticated software engineering products. Human experts are in high demand but are busy, expensive, and have difficulty searching through massive amount of data to detect malware. In this paper, we develop algorithms for machines to learn visual pattern recognition processes from human experts and then to map, measure, attribute, and disrupt malware distribution networks. Our approach is to combine visualization and machine vision for an intuitive discovery system that includes visual ontology of textures, topological structures, traces, and dynamics. The machine vision and learning algorithms are designed to analyze texture patterns and search for similar topological dynamics. Compared to recent human-machine teaming systems that use input from human experts for supervised machine-learning, our approach uses fewer samples, i.e. less training, and aims for novel discoveries through human-machine teaming.


  • Visualization
  • Malware
  • Malware distribution network
  • Human-machine teaming
  • Machine learning
  • Computer vision
  • Pheromone
  • Security
  • Dynamics
  • Graph

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-030-20488-4_10
  • Chapter length: 12 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
USD   149.00
Price excludes VAT (USA)
  • ISBN: 978-3-030-20488-4
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   199.99
Price excludes VAT (USA)
Fig. 1.
Fig. 2.
Fig. 3.
Fig. 4.
Fig. 5.
Fig. 6.
Fig. 7.
Fig. 8.
Fig. 9.
Fig. 10.
Fig. 11.


  1. Gu, G., Perdisci, R., Zhang, J., Lee, W.: BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection. In: Proceedings of the 17th USENIX Security Symposium (Security 2008) (2008)

    Google Scholar 

  2. Gu, G., Zhang, J., Lee, W.: BotSniffer: detecting botnet command and control channels in network traffic. In: Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS 2008) (2008)

    Google Scholar 

  3. McCoy, D., et al.: Pharmaleaks: understanding the business of online pharmaceutical affiliate programs. In: Proceedings of the 21st USENIX Conference on Security Symposium, Ser. Security 2012, pp. 1–1. USENIX Association, Berkeley (2012)

    Google Scholar 

  4. Karami, M., Damon, M.: Understanding the emerging threat of ddos-as-a-service. In: Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (2013)

    Google Scholar 

  5. Google safe browsing.

  6. Peryt, S, Morales, J.A., Casey, W., Volkmann, A., Cai, Y.: Visualizing malware distribution network. In: IEEE Conference on Visualization for Security, Baltimore, October 2016

    Google Scholar 


  8. MouselabWEB.

  9. Barzdinš, J., Barzdinaš, G., Cerans, K., Liepinš, R., Sprogis, A.: OWLGrEd: a UML style graphical notation and editor for OWL 2. In: Proceedings of the 7th International Workshop on OWL: Experiences and Directions (OWLED 2010), volume 614 of CEUR-WS (2010)

    Google Scholar 

  10. Kost, R.: VOM – Visual Ontology Modeler (2013).

  11. Howse, J.: Visualizing ontologies: a case study. In: International Semantic Web Conference, ISWC 2011, pp. 257–272. Springer, Berlin (2011)

    CrossRef  Google Scholar 

  12. van der Maaten, L.J.P., Hinton, G.E.: Visualizing non-metric similarities in multiple maps. Mach. Learn. 87(1), 33–55 (2012)

    MathSciNet  CrossRef  Google Scholar 

  13. Nataraj, L., et al.: Malware Images: Visualization and Automatic Classification, VizSec 2011, 20 July 2011

    Google Scholar 

  14. Cai, Y.: Pheromone-based visualization model of malware distribution networks. In: International Conference on Computational Science, to appear on Springer LNCS (2018)

    Google Scholar 

  15. Wigglesworth, V.B.: Insect Hormones, pp. 134–141. WH Freeman and Company, Holtzbrinck (1970)

    Google Scholar 

  16. TopQuadrant. TopBraid Composer.

Download references


The authors would like to thank research assistants Pedro Pimentel and Sebastian Peryt for early prototypes. This project is in part funded by Cyber-Security University Consortium of Northrop Grumman Corporation. The authors are grateful to the support from Drs. Paul Conoval, Robert Pipe, and Donald Steiner. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Internal use: * Permission to reproduce this material and to prepare derivative works from this material for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works. External use: * This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other external and/or commercial use. Requests for permission should be directed to the Software Engineering Institute at * These restrictions do not apply to U.S. government entities. Carnegie Mellon® and CERT® are registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. DM19-0291.

Distribution Statement A: Approved for Public Release; Distribution is Unlimited; #19-0490; Dated 04/17/19.

Author information

Authors and Affiliations


Corresponding authors

Correspondence to Yang Cai , Jose A. Morales , William Casey or Neta Ezer .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Verify currency and authenticity via CrossMark

Cite this paper

Cai, Y., Morales, J.A., Casey, W., Ezer, N., Wang, S. (2020). Perceiving Behavior of Cyber Malware with Human-Machine Teaming. In: Ahram, T., Karwowski, W. (eds) Advances in Human Factors in Cybersecurity. AHFE 2019. Advances in Intelligent Systems and Computing, vol 960. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-20487-7

  • Online ISBN: 978-3-030-20488-4

  • eBook Packages: EngineeringEngineering (R0)