The problem
Malware analysis usually starts with the binary — unpacking, disassembling, signature-matching. But binaries are cheap to mutate; what malware can hide far less easily is its need to phone home. Command-and-control (C2) communication is where an infection reveals its purpose: what it exfiltrates, what instructions it awaits, what family it belongs to.
The approach
ArkThor categorizes threats by analyzing their C2 communication patterns rather than their binaries. Captured traffic (PCAP) is processed through a detection pipeline that classifies the threat and assigns a category and severity — turning raw packet captures into triage-ready intelligence for SOC teams and researchers.
The work was peer-reviewed and published at the 10th International Conference on Information Systems Security and Privacy (ICISSP 2024) in Rome, where it was recognized as a Best Position Paper Candidate.
Research that ships
The lab's standing rule applies to research too: a paper without an artifact is a promise, not a contribution. The complete ArkThor implementation is open source — the pipeline, the categorization engine, and the analysis tooling are all public and runnable.
Lineage
ArkThor's C2-analysis experience feeds directly into the lab's current AI-security work — KavachRT applies the same adversarial mindset to a new attack surface: AI systems themselves.