SEM FRONTEIRAS Malware Investigation Law Enforcement Agencies must cope with evi-

dence from multiple different sources, a short-age of skilled cybercrime agents and inefficient data exchange between stakeholders. Among the digital offences most frequently in-vestigated, there are phishing attacks aimed at spreading financial services-targeted malware. Such malicious software is normally sold to, and used by, multiple thieves, which vastly outnum-ber the amount of developers. Arresting malware programmers, albeit more challenging, could have a cascade effect on the Online Banking Malware (OBM) ecosystem. Therefore, novel investigation techniques bal-ancing cybercrime domain knowledge and com-puter processing power should be researched. Applying Ontologies Semantic technologies could enhance relation-ship discovery and hypothesis testing within the OBM domain. For instance, supporting analysts in reasoning among a large volume of scattered, supposedly unrelated evidence. By defining concepts and their relationships, properties and value types, an ontology allows: • Analysts and computer software to share a common domain understanding, enhancing interaction and information exchange; • The reuse of domain knowledge: e.g. file hash concepts are also useful for investigating oth-er cybercrimes; • To easily devise domain assumptions: e.g. “malware family X has at least 3 of their em-bedded files identical”. Main Objectives • Link different criminal organizations • Identify malware developers • Facilitate future data integration • Optimize cyber evidence retrieval Current and Future Work A working prototype with a reduced set of the most relevant concepts relating to the malware (contact medium, URL, keyword and hash) is being implemented. Next, concepts from entities (contact, nick-name, user login and messages exchanged) will be incorporated into the implementation. Future work will: • Load real data into the knowledge base to val-idate and improve the inference rules ’ effi-ciency and efficacy; • Refine the approach to malware string match-ing by analysing previous research and sand-box platforms; • Research Natural Language Processing tech-niques to automate entity extraction and pro-vide content-based categorisation; • Create an online resource to foster OBM ontol-ogy discussion and improvement among La